Add support for go 1.6-style vendoring.

I think longer-term it might be nice to remove the use of Path for go package names. It's definitely convenient but they're not really real paths and it confuses the rule key builder pretty badly.