Currently we pin `cargo-vendor` to 0.1.4, which doesn't set the `User-Agent` HTTP header. crates.io is going to require that header in the near future, so this PR bumps the pinned version of the crate to the latest one (which correctly sets the header).