Update vendored dependencies automatically (with human review)

#205 is an example of how to do this, but doesn't work with our vendoring tool, `dep`. Whatever solution we choose needs human review so that we don't automatically accept bugs, too. (It looks like #205 does this, FWIW, via https://github.com/apps/forking-renovate.)

Start by reviewing issue #205 and the referenced forking-renovate approach, then compare that workflow with the repository's use of `dep`. Define an update process that supports human review before dependency changes are accepted; completion should provide a documented, working approach compatible with `dep`.

Written by the indexing model from the issue text.