vendor: add a vendor directory

[jedevc]

This does a couple of things:

• Keeps us inline with other "build" repos - buildx, buildkit, etc.
• Makes dependabot for new versions of syft a lot easier to review, since we can easily analyze exactly what code that we are using is changing.

A bit too fast for this review

[crazy-max]

buildkit-syft-scanner/Dockerfile

Lines 43 to 46 in 3dc2dd0

	RUN --mount=type=bind,source=go.mod,target=go.mod \
	--mount=type=bind,source=go.sum,target=go.sum \
	--mount=type=cache,target=/go/pkg/mod \
	go mod download -x

needs to be removed

buildkit-syft-scanner/Dockerfile

Line 50 in 3dc2dd0

--mount=type=cache,target=/go/pkg/mod \

as well

Also needs https://github.com/docker/buildx/blob/daba16f4be78f4bb6bb6ac73ac5c5615023a2bd7/Dockerfile#L20

[jedevc]

Woop, thanks @crazy-max ❤️