vendoring improvements
- Add pruning of stale files to vendor
- Before blindly reading the lockfile, also check if
package.json
has changed This will reduce the number of cases where --force needs to be used, which I found counterintuitive and annoying
Bug: T326291