How are dependencies added or updated?

[nyarly]

According to CONTRIBUTING.md, the core team maintains dependencies, and updates to vendor/ should be handled via discussion with them.

I opened #16420 to get a complete version of go-migrator added to the project, and that ticket was marked as help wanted by @wy65701436 - I'd be happy to do the work, but the "how" isn't clear to me.

So far, I've tried removing the vendor/ directory and running go mod vendor - maybe that worked once, but there seem to be a lot of absent dependencies now. Separately, I tried go geting the module I needed, and copying it into place. That led to a lot of missing dependencies (perhaps why it was stripped?), and I didn't want to burn hours manually fetching each of them, especially if that's not the approved approach.