Baseline release for those who want to vendor

As pointed out in #306 we haven't done formal release tags since 2013. As Go's vendoring and dependency management story has now started to crystalise, it does feel like a good time to change this.

Plenty of people are using xlsx in production, so let's formally call the current state v1.0.0.