chore: vendor ocm

[jakobmoellerdev]

What this PR does / why we need it

This is a PR that vendors the OCM Dependency Chain.

Why?

Go Modules takes care of versioning, but it doesn't necessarily take care of modules disappearing off the Internet or the Internet not being available. If a module is not available, the code cannot be built.

For OCM this is relevant for 2 reasons:

1. We have a huge dependency graph, and simply rebuilding with a full build cache takes 1 minute on a fast network
2. We are a build CLI that is critically important regarding versioned dependencies. If a dependency drops from the go module proxy, we have no alternative without a vendored version to build OCM. this is a potential attack vector for a supply chain attack.

Which issue(s) this PR fixes

[github-actions]

This PR exceeds the recommended size of 10000 lines. Please make sure you are NOT addressing multiple issues with one PR. Note this PR might be rejected due to its size.