Eliminate different yaml parsing/serializing dependencies

[ahmetb]

Looks like we ended up with 3 different yaml parses in this repo (oops).

1. k8s.io/apimachinery/pkg/util/yaml (originally used) used in pkg/index/indexscanner to parse plugin manifest files
2. gopkg.in/yaml.v2 used by cmd/validate-krew-manifest
3. github.com/ghodss/yaml used in pkg/receipt and pkg/info (added in Save install receipt #195)

Ideally, I'd be eliminating number 2 & 3. However, it looks like k8s.io/apimachinery/pkg/util/yaml actually doesn't know how to serialize yaml (no marshal method).

Looks like (https://godoc.org/k8s.io/apimachinery/pkg/util/yaml?import-graph&hide=1) that package is depending on sigs.k8s.io/yaml which depends on gopkg.in/yaml.v2. So I'll probably just depend on sigs.k8s.io/yaml instead.

/kind cleanup