More resilient copying of vendor to the bazel sandbox

Previous release used cp -r to replicate the vendor directory in the bazel build sandbox. However, -r incorrectly handles malformed symlinks (which are beyond our control). Move to using -a (archive) which will do the right thing.

Note that -a behavior is slightly different on various platforms (macOS is -pPR and GNU tooling is -dR) but these differences shouldn't matter for our use.