Move dep ensure -vendor-only to the DeltaWriter

[sdboyer]

#1912 introduced the DeltaWriter, which regenerates only the parts of vendor that have changed, instead of all of it. i didn't use it for the dep ensure -vendor-only path, however, because DeltaWriter.Write() will also update Gopkg.lock right now. It's fixable, but it's a little awkward without jamming some new parameters into the API, and i didn't have the bandwidth to handle to come up with a more elegant solution. (Plus, it's a nice backstop against bugs in the DeltaWriter - there's still at least sorta a way of accessing the old behavior)

Still, -vendor-only does need to move away from SafeWriter sooner rather than later.

[mvdan]

Dep was officially deprecated earlier this year, and the proposal to archive this repository was accepted. As such, I'm closing outstanding issues before archiving the repository. For any further comments, please use the proposal thread on the Go issue tracker. Thanks!