Deps: vendored dependencies as a source #233

Part of #227. Proposal: ComlineProject/docs#163, proposals/offline/supply.md#vendoring.

A project directory holding every dependency (transitive ones included), each with its pin and hash, which a build uses in place of fetching when the copy matches its pin. Core side of comline vendor.