docs: update README to note vendor deps