Use gom to manage dependencies

Switching to this required figuring out the commit
numbers for the existing vendored things.  A diff between the resulting
_vendor directory and the existing vendor dir reveals that the only
differences are the SCM bits (.git directory etc).