Exclude vendor/, etc. by default

[mcandre]

Exclude vendor (Go), node_modules (npm). This minimizes the chance of a third party dependency triggering a less actionable linter warning.

Yes, technically go mod vendor has a nasty policy currently of stripping out non-Go files such as makefiles. But some legacy projects may have submodules or other faff at vendor.

Relates to #10.

Relates to #121.