vendoring improvements

• Add pruning of stale files to vendor
• Before blindly reading the lockfile, also check if package.json has changed This will reduce the number of cases where --force needs to be used, which I found counterintuitive and annoying

Bug: T326291