Move upstream packages into a "vendor" directory