all vendor dependencies in Gopkg.toml now have constraints. this will
ensure that they do not float as people run `make vendor`. if you need
a new package be sure to change the contraint explicitly.
Signed-off-by: Bassam Tabbara <bassam@upbound.io>