Add mechanism to update vendored dependencies automatically

[pganssle]

In the long run, I would love to have a bot that makes automatic PRs whenever our vendored dependencies are updated. In the short run, I think we can be satisfied with the following setup:

1. A script and/or tox environment that we can run that does the update for us.
2. A weekly CI job - either not run during normal PR, or run as an "allowed failure" during normal PR - that runs the script and notifies us if it fails, so we can manually do the update.