Remove vendor dir

To do so, we need to address the use cases it serves:

1. **It makes it obvious when we're increasing our binary size too much.** We could do this with a GH PR check that adds a comment to the PR "binary size is now $X".
2. **It's easy-ish to scan our new dependencies and make sure they have OSS-compatible licenses.** Likewise, a bot could call `go mod vendor` and do some automated license checks, or at least print out a table with a link to the license for each dep (ideally highlighting new/changed deps).
3. **It (ideally) confirms that the dependency versions in prod are the same as those tested by our CI.** This is handled by `go.{mod,sum}`; nothing to do.

Start by reviewing the vendor directory, go.mod, and go.sum, then trace how CI and production use dependency versions. Define replacement checks for binary-size changes and dependency license visibility; the work is done when those use cases remain covered without the vendor directory.

Written by the indexing model from the issue text.