Add a Gopkg.toml field for skipping vendor verification

[sdboyer]

The automated vendor verification introduced in #1912 is lovely, but it's definitely going to cause problems for some people. We need to add another field to Gopkg.toml that allows the user to designate projects (not packages, whole projects) for which verification should be skipped.

Skipping verification means that:

1. dep ensure will have to unconditionally write out such projects, in much the same way that it used to unconditionally write out all projects to vendor
2. dep check (per dep: Introduce dep check subcommand #1932) may or may not still print notices for non-verified projects when they come back from vendor verification as changed, but even if it does, it won't error if there's a hash mismatch.