Note that the opencontainers/go-digest part of the repository has 2 license files, LICENSE.code and LICENSE.docs. Based on the file extensions, one appears to contain the license for the source code and the other for the documentation.
The .go files themselves and the LICENSE.code file all refer to the Apache 2.0 license as being applicable. It appears that the documentation has been stripped from this copy of opencontainers/go-digest, so the LICENSE.docs can be ignored.
TL/DR: Yes, it is safe to use fabric in a closed-source project. The CC-BY-SA license you found in the vendor section does not actually apply to any portion of the code.