Avoid commiting vendor.tar in the repo

[jprendes]

Honestly, I don't have a strong concern (except for maybe something about the repository size); I just really don't like committing built artifacts if it can be helped, especially because keeping them in sync always seems to be a bit of a pain.

I was thinking that cargo basically is just checking git HEAD == git index == working-tree, so we could just do our own script that checks git HEAD == git index and git index == working-tree - vendor.tar (and vendor.tar matches working tree/index for the things it should have in it). Totally up to you though :)

Originally posted by @syntactically in #83 (comment)