Adjust the vendor directories being tracked (over time)

[dwattttt]

Similar to #100, if new vendored dependencies need to be tracked after mirroring has started, it would likely miss crates that were added to the tracked registry prior to the last sync (i.e. crates from before the current master checkout of the index).

panamax verify's purpose is to download crates that are "missing" from the list of downloaded crates; would it be possible to allow verify to also take a vendor directory (possibly multiple directories re. #100), which would download any newly tracked dependencies.

[dwattttt]

#104 works for this (by my limited testing)

[dwattttt]

This has solved my use case, thanks.