this commit updates dep to version 0.5, and adds a check during
CI runs that enforces that the vendor dependencies have not changed.
There is a now a makefile target `make vendor.check` that performs
this check. Also removed the requirement that PR run make vendor as
this will be done by CI.
Signed-off-by: Bassam Tabbara <bassam@upbound.io>