validate/vendor: always tidy
**- What I did**
Prevent #44453 or similar by always running `go mod tidy` when checking vendoring.

**- How I did it**
Allow running individual steps in `hack/vendor.sh` while still using it as the exclusive wrapper for `go mod` by introducing 'subcommands'; the default behavior is identical to the previous (which is now aliased as the `all` subcommand).

Make `hack/validate/vendor` take advantage of these split steps, and refactor it to be more robust against whitespace/follow bash best practices.

**- How to verify it**
Manually; revert #44453 locally to test tidy detection, and commit a modification to a vendored file to test re-vendor detection.

**- Description for the changelog**
N/A

**- A picture of a cute animal (not mandatory but encouraged)**
![](https://cdn.discordapp.com/attachments/704333319697072231/1041724104077750373/78191E84-9FF7-4BE8-9F2D-D94EEEAA48FA.jpg)


hack/go-mod-prepare.sh
#!/usr/bin/env bash

ROOTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

cat > "${ROOTDIR}/go.mod" << EOF
module github.com/docker/docker

go 1.18
EOF

#!/usr/bin/env bash

set -e

SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOTDIR="$(git -C "$SCRIPTDIR" rev-parse --show-toplevel)"

set -x

tee "${ROOTDIR}/go.mod" << EOF
module github.com/docker/docker

go 1.18
EOF

Was there a specific reason to use `tee` for this? This also prints the `go.mod` on stdout (whereas the old one only wrote it to the file)