Support repositories that do not have dependencies vendored

A few open issues relate to the fact that gta currently require dependencies to be vendored. I have opened this issue to centralize discussion around a potential feature that allows gta to function on repos that don't vendor dependencies.

## Workaround

[This](https://github.com/digitalocean/gta/issues/27#issuecomment-2349652478) comment from @matthewd98 describes a workaround, which is essentially automation that will vendor the dependencies for both the `-base` ref and the current head to satisfy the requirement that dependencies are vendor (at least for the two refs being compared).

## Potential solutions

One possible solution would be to implement the "workaround" into gta, and allow it to vendor the dependencies on the two refs for you, but this would have to be implemented carefully so that completes cleanly without altering the git repo. This is less of a concern in CI, where repos are just temporary clones, so this may be fairly straightforward to implement as an extra step in the GitHub Action. But that would mean this feature is lacking in the gta CLI.

There may be other ways to pull and analyze dependencies (and recursively, their dependencies) without vendoring, but reading through existing issues, I don't think any specific methods have been identified or described in detail yet.

Start by reading the workaround in issue #27 and the existing gta CLI and GitHub Action entry points. Compare how each currently requires vendored dependencies and determine whether a safe approach can handle both refs without altering the repository. Done means a documented, tested design or implementation for repositories without vendored dependencies.

Written by the indexing model from the issue text.