Use a hidden directory for vendored deps

Using a valid package name for putting dependencies in creates confusion in other tooling, is much nicer to put them somewhere at least hidden.