Return spec from add_vendor_gem

The lockfile expects adding a vendor gem to return a spec so
dependencies can be added to it, but this did not happen.  Now a
Gem::Specification is returned but this seems to cause problems further
down when adding the dependencies.

There may be some untested or copy-paste code here.

Part of #985
Parse lockfile dependencies without operator

The lockfile may contain a bare version string that has no operator.
This was not handled by the lockfile parser which would result in an
incorrect dependency.

Part of #985
Add PATH lockfile dependencies correctly

Due to lack of tests, adding a dependency to a vendor set did not due
to incorrect method calls.

Fixes #985