Ensure we always build from vendored deps, and test for mod tidy

[nickatsegment]

I noticed that our vendored deps are way out of date. This PR causes CI to build from vendored deps by default, and also checks that the vendored deps are complete.

Building from vendored deps ensures we know and have the exact code we intended.

The CI runs for this PR show how it would fail tests:

• https://circleci.com/gh/segmentio/aws-okta/636 fails the tests because there are a number of vendored deps missing:

go: downloading github.com/danieljoos/wincred v1.0.1
...
git tree is dirty after tidying and vendoring modules
ensure go.mod and go.sum are tidy and vendor is checked in
On branch ensure-vendor-build
Untracked files:
  (use "git add <file>..." to include in what will be committed)

	vendor/github.com/99designs/keyring/.travis.yml
...
	vendor/golang.org/x/sys/windows/

nothing added to commit but untracked files present (use "git add" to track)
Exited with code 1

• https://circleci.com/gh/segmentio/aws-okta/637 shows the build failing because we are missing some newer deps:

mkdir -p dist
GOOS=linux GOARCH=amd64 GO111MODULE=on go build -mod=vendor -ldflags='-X "main.Version=v0.21.0-9-g344f6fe"' -o dist/aws-okta-v0.21.0-9-g344f6fe-linux-amd64
build github.com/segmentio/aws-okta: cannot load github.com/alessio/shellescape: open /go/src/github.com/segmentio/aws-okta/vendor/github.com/alessio/shellescape: no such file or directory
Makefile:25: recipe for target 'dist/aws-okta-v0.21.0-9-g344f6fe-linux-amd64' failed
make: *** [dist/aws-okta-v0.21.0-9-g344f6fe-linux-amd64] Error 1
Exited with code 2

• https://circleci.com/workflow-run/1eed6c8e-e945-4d92-baa0-9eb6a6904cfe shows everything working after I did go mod tidy && go mod vendor.

[boggsboggs]

Cool. I don't really know how go modules work, but this seems like a well thought out change