Vendor only modified dependencies.

It keeps record of the current vendored dependencies under `.gopack/vendor/gopack.lock`.
Then it uses that file to compare changes with the configuration
and download only dependencies that have been modified.