Adding option to download remote files as part of the gem

- Adding minitar as dependency
- Adding vendor file to handle the tasks
- Adding vendor hook to install and update actions

the vendor.json file should be placed at the root of the gem file
This file defines all the remote sources that should be downloaded.
The content of it is an array of hashes.
Each hash has the following settings:
- url
- sha1
- files

url is the url of the remote source
sha1 is the sha1 fingerprint we use for validation of the downloaded file
files can have different settings and is only used for .tar.gz / .tgz files
not setting it extracts the whole tar.gz file
An array of files allows to extract specific files
A Regexp allows extracting specific files

Fixes #2029
Move most common functions away into a util method

Fixes #2029
Update after review

Fixes #2029