update can introduce unvendored dependencies

[FiloSottile]

The update command will download a new version of a single package. However this new version might have new dependencies, which end up not being vendored.

By default update should download any new missing packages. It should however probably not update the entire recursive dependency tree, unless asked (see #6). If this introduces conflicts, they are for the human to fix.