Bump vendir to 0.40.0

[antgamdia]

What this PR does / why we need it:

This PR updates vendir to the latest v0.40. Since they renamed the module name to carvel.dev/vendir (see their go.mod), people using kapp-ctrl as a dependency won't be able to upgrade their vendir dep because a module name mismatch (for example, we in Kubeapps).

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?

NONE

Additional Notes for your reviewer:

I'm not familiar with this repo; I mostly run a bulk rename, run go mod tidy, run go mod vendor and finally run ./hack/gen.sh, so please let me know if I'm missing something to ensure everything continues to work as expected.

Review Checklist:

• Follows the developer guidelines
• Relevant tests are added or updated
• Relevant docs in this repo added or updated
• Relevant carvel.dev docs added or updated in a separate PR and there's
  a link to that PR
• Code is at least as readable and maintainable as it was before this
  change

Additional documentation e.g., Proposal, usage docs, etc.:

[praveenrewar]

Hey @antgamdia Thanks for creating the PR. We have an open PR #1495 by @joaopapereira, which is also bumping vendir to v0.40.0 (plus some additional changes). Right now the tests are failing on that, so we need to look into it. Just curious how urgent this change is for y’all.

[antgamdia]

Thanks for the quick reply! I looked for other ongoing PRs bumping it up but didn't notice that one.

No rush at all. I simply was reviewing our deps to keep them up to date and simply bumped into this incompatibility with vendir latest version. But there is no urgency at all.

Happy to close this PR and defer the upgrade to the one you mentioned. As you prefer :)