1/3 Updated Makefile to allow VENDOR flag (adds -vendor to version string)

2/3 Added vendor/ dir to lock down dependent pkg versions.
The author of git.schwanenlied.me/yawning/{chacha20,newhope,kyber}.git has copied
their repos to gitlab.com/yawning/ but some imports of chacha20 from newhope still
inconsistently refer to git.schwanenlied.me/, breaking build.
Licenses for chacha20 also changed from CC0 to AGPL, which may or may not be an
issue. Until the two aforementioned issues are resolved, locking to last-good
versions is probably the best way forward for now.

To build with vendored deps, use make VENDOR=1 clean all

3/3 Moved body of CI push script into bacillus/

vendor/gopkg.in/hlandau/passlib.v1/abstract/compare.go

@@ -0,0 +1,11 @@
+package abstract
+
+import "crypto/subtle"
+
+// Compares two strings (typicaly password hashes) in a secure, constant-time
+// fashion. Returns true iff they are equal.
+func SecureCompare(a, b string) bool {
+	ab := []byte(a)
+	bb := []byte(b)
+	return subtle.ConstantTimeCompare(ab, bb) == 1
+}