Specify vendordep json file format

[spacey-sooty]

• [ ] Create accurate specification for current format
• [ ] Add tests to ensure that we don't silently break current format
• [ ] Update errors to point to the specification when it is useful

[spacey-sooty]

I'm guessing I'm missing a lot of things here