validate-vendor.bash not validating correctly

[sdboyer]

In pulling together #644, I noticed that hack/validate-vendor.bash isn't working correctly. It currently runs dep ensure to check for diffs in vendor/ against HEAD; the problem is, if the solving inputs are the same for what's in HEAD and what's in Gopkg.lock, then it won't actually write vendor back out.

With the current command set, there's no way to override this behavior. The new spec does have a flag, -vendor-only, that will force it to write out vendor. Until then, we'd have to hack it to ensure we're always getting the right check - e.g., awk Gopkg.lock to drop the memo field before running dep ensure.