add the --verify option

This is the second attempt at #535 - this time targeting the gulp 4 branch. I think I've tackled all the comments left in the original PR (#668) 
I think there are probably modules for finding the package.json that may be more verbose than this.