Consider vendoring dependencies

[bentekkie]

Would the rootlesskit project consider checking in vendored go dependencies using https://go.dev/ref/mod#vendoring?
If so would you accept a PR to add this?

[fahedouch]

Would the rootlesskit project consider checking in vendored go dependencies using https://go.dev/ref/mod#vendoring? If so would you accept a PR to add this?

why should we enable vendoring ?