replace dep with go mod (#3907)

Replace sha1sum with jack's gosum and get rid of
vendor-deps.
Also don't compute hash on vendor/ contents.
Instead hash go.sum.

Disable unconvert lint check. It does not
work very well with go mod.

Remove update_vendor_deps once and for all.

Upgrade to go 1.12

Closes: #3919 #3630

cmd/gosum/main.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"log"
+	"os"
+)
+
+// DONTCOVER
+
+// nolint: errcheck
+func main() {
+	f, err := os.Open(os.Args[1])
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer f.Close()
+
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Printf("%x", h.Sum(nil))
+}