Investigate the pip-spinout vendoring tool

[gsnedders]

see https://github.com/pradyunsg/vendoring

it's poorly documented (it's a spin-out of pip's vendoring tool), but it does many things our current setup doesn't (like import rewriting, which would allow us to finally resolve #10888 (remove localpaths.py)

we'd need to decide whether we'd want to support unbundled execution, or whether we'd want to force everyone to always use the vendored packages