Add mediawiki/vendor repository

Created by: MusikAnimal

I am working on https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UrlShortener/+/930716 which requires a new package in mediawiki/vendor that is not yet merged and must undergo security review. it'd be awesome if in the meantime we could demo it!

I'm not sure if this is as simple as allowlisting the repository? It seems like there are potential security issues just as with #19 (closed). There was talk at #112 about having a separate repository with the list of trusted users who can change sensitive things like this. Maybe if we move forward with that, the same repo could be checked for vendor changes.