Do not check DeprecationDate when comparing dependencies

[c0d1ngm0nk3y]

Summary

This might be an alternative to #233 in addressing short comings when comes to comparing the metadata of a dependency.

• DeprecationDate does not work with reflect.deepEqual for 2 reasons
  • After Marshal and Unmarshal, the time.Time cannot be compared anymore, since it will loose some precision because of the missing UnmarshalTOML
  • Even WITH the fixed unmarshaling, the compare will work, but the reflect.deepEqual will still fail because it compares the exact internal structure.
• If the CPEs array is empty, those a arrays are not considered to be reflect.deepEqual

Use Cases

As discussed in #233, comparing the metadata of a dependency is probably not needed at all if sha256 is the same. But at least the comparison should be successful in those cases since the dependency caching currently depends on it.

Checklist

• [X] I have viewed, signed, and submitted the Contributor License Agreement.
• [X] I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
• [ ] I have added an integration test, if necessary.
• [X] I have reviewed the styleguide for guidance on my code quality.
• [X] I'm happy with the commit history on this PR (I have rebased/squashed as needed).

[modulo11]

This looks like a cost-efficient and compatible alternative until #233 can be continued on a v2 branch. @dmikusa is there anything holding us back from merging it?