add vendored deps, update build process

[cwarnerdev]

WIP PR for vendoring deps.

The vendor/ directory will show up in PR diffs, but the files will not be loaded by default. This is default github behavior for them. We could hide them entirely but probably best to leave them at least somewhat visible.

Changes:

• Vendor all Go dependencies via go work vendor for offline, reproducible builds
• Add scripts/vendor_fix_cgo.sh to patch CGO dependencies (grocksdb, zondax/hid) whose C source subdirectories are skipped by go work vendor
• Set export GOFLAGS := -mod=vendor in Makefile; add GOFLAGS= overrides where vendor mode is incompatible (genqlient, lint-wasp-cli, go mod tidy)
• Build sub-module targets from workspace root (go build ./tools/wasp-cli/ instead of cd tools/wasp-cli && go build)
• Simplify Dockerfiles: remove go mod download caching layers, use go build -mod=vendor
• Add GOFLAGS: -mod=vendor env to CI workflows
• Fix .gitignore patterns (dist/, sdk/) to be root-relative so they don't exclude vendor contents