chore(build): use third_party.go

use the third_party.go project to replace our update script. This requires
moving a few things around and gets rid of a few annoying bugs:

- You can now bump individual packages
- A new src directory isn't created on build
- Less shell scripting!
- Things get built into ./bin/