cmd/cue: implement cue mod vendor

[rogpeppe]

Currently there is no good way to vendor dependencies into a module such that there is no need to go to an external registry.

cue.mod/pkg is one approach but that doesn't fit quite the same niche: in particular, cue mod tidy will fail if there's a matching package in an external registry. There is also no easy way to copy dependencies into that directory, and we will probably deprecate cue.mod/pkg in time.

We could implement cue mod vendor and support for a vendor directory along the lines of go mod vendor.