Vendor twofish

This is primarily to remove the rate limiting constraint imposed by golang.org/x/crypto. Vendoring means we no longer need to do the gitcookies dance to evade the rate limit, which was a problem for external pull requests.