add the --verify option

This is the second attempt at #535 - this time targeting the gulp 4 branch. I think I've tackled all the comments left in the original PR (#668) 
Yeh, I was wondering but I though that we don't want to promote the situation where people put gulp plugins as dependencies. Unless there is a legitimate use-case for declaring gulp plugins as dependencies instead of devDependencies?