remove godep in favor of gpm

[gpm](https://github.com/pote/gpm) is *exactly* the kind of lightweight tool we're looking for in order to automate reproducible builds from a list of dependencies.

Unfortunately godep went in a different (valid) direction.
can we comment human readable versions on these lines (where we have such a thing) or the date they were last bumped or something? (looks like anything after `#` should be treated as a comment)