move deps installation to vendor.sh script
gitignore: ignore bundles directory
vendor.sh can cleanly update vendored dependencies