explore how to organise vendor code

[yonadaa]

In the ERC721 PR (#1844) we copy-pasted code from OpenZeppelin instead of installing + importing the official files from NPM. We should think about how to organise this code so it's clear where it come from

[holic]

Adding a new set of contracts as an npm dependency in e.g. world package means that forge/solc in world-modules or downstream templates won't know how to resolve that new dependency. We could teach it how via remappings but that gets hairy with transitive dependencies.