We change the way auto-vendoring works such that deps that
are already vendored are not re-vendored inappropriately.  It was
found that nested vendoring could break the previously employed
scheme.

For example, consider a package "foo/bar/baz".  It's conceivable that
a vendor folder may appear anywhere in that hierarchy, e.g.

[ "foo/vendor", "foo/bar/vendor", "foo/bar/baz/vendor"]

and golang would recognize the contents as a legitimate vendor.

This was precisely the situation when we had chaincode in the package

github.com/fabric/hyperledger/examples/chaincode where

github.com/fabric/vendor was in effect.

We now scan the entire package heirarchy to ensure we capture the
potential relationships regardless of where they sit in the tree.

Fixes FAB-4883

Change-Id: I7c6aa5ba0401cecc26bc58f5e6cda6e208109411
Signed-off-by: Greg Haskins <gregory.haskins@gmail.com>