Un-auditable dependencies in GRR code

We are acquiring a number of dependencies on external, unauditable blobs that are required for using GRR. While its true that we'll always depend on blobs of code, at least if they are tracked in a code repo users have an option to track the changes and updates.

I don't think its a necessary state for the things we control, so would be great to start removing some of them, or at least justifying why they are there, from a brief look I found:

Server debs on docs:
https://github.com/google/grr/blob/master/scripts/install_script_ubuntu.sh#L21

Rekall component on apache server:
http://images.rekall-forensic.com/share/rekall-core-1.5.0.tar.gz#egg=rekall-core-1.5

Chipsec component (chipsec fork tarball in docs):
(relies on link in docs, fix in progress)

mrgcastle Vagrant images vs upstream:
https://github.com/google/grr/blob/master/vagrant/Vagrantfile#L14