put block around main_vendor js in main_django.html

should be a no-op for edx-east, but allow edx-west to remove
vendor.js with a blank {% block %}
in our password_reset_confirm.html to fix a bug
Merge pull request #396 from edx/jbau/fix/stanford-pwdreset-remove-vendor-js

put block around main_vendor js in main_django.html