Implement tidy function/command for invalidating index file

Tidy command should at least check direct dependencies of the package listed in index.json and check against package content (CTIs)
- all and only direct dependencies should be listed in index.json
- package should not have hidden (transitive) dependencies not listed in index file