We should add a test in vet.sh to confirm that the dependencies of grpc don't change without our noticing (i.e. vet should fail if they don't match the current list).

go list can pretty easily show dependencies. We should only be checking our direct dependencies and not our transitive dependencies, since we have no control over the transitive ones. We should check the grpc package, the xds package, and any other important packages that are not imported by either of those directly.