Make unvendored_deps.sh more robust:

* Search packages in sub-directories of the repo root.
* Don't list the current package or its sub-packages as un-vendored.

(Crony doesn't currently have any non-main packages, so this is a no-op for now)