Switch from `third_party.go` to `gom` for dependency management

We've had some discussion at GDS recently about how we'd like to do
dependency management for our Go applications.

This minimal change moves us to use `gom` over the `third_party.go`
file to be consistent with the choices we've made.
Amended in e0fa99d to pin to SHA1s.