Vendor dependencies to manage risk of source compromise

[DanielHeath]

If one of the upstream providers injects malicious code, anyone who builds credulous from source will get it by default.

An alternative is to vendor upstream sources (by e.g. checking copies into this repo); this means that updates are pulled in by the Credulous team rather than automatically sent to anyone who builds from source.

[DanielHeath]

This would also remove the bzr dependency.

[nonspecialist]

Yeah, this is probably a good thing to do a little later on, when the frantic pace of change slows a little.