service catalog must check-in its vendored dependencies

[derekwaynecarr]

The service catalog needs to check in its vendor code into the source tree.

1. we cannot rely on vendored projects we rely on today existing tomorrow
2. we need to be able to build past releases of service catalog in the future in case of security fixes, etc. not having those dependencies checked into the repository makes us unable to provide that guarantee
3. we need to also ensure that every dependency must have a license per coding convention guidelines https://github.com/kubernetes/community/blob/42ec015a21824ab2698e1f7b9c8bf7bb4df69d49/contributors/devel/coding-conventions.md

While I cannot find it directly stated, I think this should be a requirement for incubation.

For reference on best practice, see examples below:

Kubernetes

https://github.com/kubernetes/kubernetes/tree/master/vendor
https://github.com/google/cadvisor/tree/master/vendor
https://github.com/kubernetes/kops/tree/master/vendor
https://github.com/kubernetes/heapster/tree/master/vendor
...

Kubernetes incubators
https://github.com/kubernetes-incubator/cri-o/tree/master/vendor
https://github.com/kubernetes-incubator/kube-aws/tree/master/vendor
https://github.com/kubernetes-incubator/kompose/tree/master/vendor
https://github.com/kubernetes-incubator/rktlet/tree/master/vendor
https://github.com/kubernetes-incubator/cluster-capacity/tree/master/vendor

[krancour]

While I will not dispute the other points, to be fair, I have to correct this one:

all vendored code must have a version specified - existing glide.yaml does not make a version declaration for many items

glide.yaml does not; but glide.lock does-- for every dependency.

[pmorie]

I agree that we must do this; I think that we should do it now.

[arschles]

I don't like checking in vendor directories, but we need to do it. Dependencies are a golang-proper problem, and I don't want to waste any more time trying to solve it "elegantly".

[derekwaynecarr]

@krancour - you are correct re: glide.lock. updated the original issue description.

[MHBauer]

I am generally fed up with this aspect of go, so fine, do it, get it done, whatever I do not care anymore.

I do not see how linking to the vendor directory of other projects proves anything at all regarding best practices.