Meta-merge of all changes to stabilize Gopkg.{toml,lock}

[sdboyer]

This PR is an agglomeration of a number of different open PRs - #631, #584, #538 - which collectively make breaking changes to Gopkg.toml and Gopkg.lock's structure in order to bring them into a stable, backwards-compatibility friendly form - it closes #276.

I've smashed everything together into one PR in order to make the changes all at once, preventing any pesky merge conflicts that might appear incrementally. Reviews are welcome, though the individual PRs have all already been reviewed, so they can probably be restricted to checking for integration issues.

Merging this will cause all existing Gopkg.toml and Gopkg.lock files to become invalid. This is the last time we plan to have a backwards-incompatible change to the files.

If folks want to avoid throwing away their existing files, manually applying the following series of changes should work:

1. In Gopkg.toml, replace all [[dependencies]] with [[constraint]]
2. In Gopkg.toml, replace all [[overrides]] with [[override]]
3. If you have any exact version constraints specified in Gopkg.toml, e.g. version = "1.1.0", the meaning of these will change; you may want to convert them to e.g. version = "=1.1.0" to achieve the same effect. (But please consider not doing that - having a flexible version should not be harmful to you!)
4. In Gopkg.lock, add the following table:

[solve-meta]
  analyzer-name = "dep"
  analyzer-version = 1
  inputs-digest = "$MEMO"
  solver-name = "gps-cdcl"
  solver-version = 1

Replacing $MEMO with the value currently in the memo field of your Gopkg.lock.

fixes #225 fixes #421 fixes #508 fixes #509

[googlebot]

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored by someone other than the pull request submitter. We need to confirm that they're okay with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of the commit author(s) and merge this pull request when appropriate.

[carolynvs]

Why was this required to begin with? I would have thought the direct dependency (below) would have been enough, so I'm not sure why it was needed before and not anymore?

[sdboyer]

for a while there (pre gps move) we didn't directly import it, and thus couldn't constrain it, so we kept getting the wrong version.