Use go modules in libraries that are not vendoring dependencies

Some libraries aren't vendoring their dependencies at all right now, which leads to a headache around making sure that all downstream repositories explicitly include the correct dependencies.