make-release-tarball could check the packages with depenencies.tsv.

We saw another cases where a dep of a dep was pulled into the tarball. it is legitimate, but undocumented. We also saw a case where an old library/package was pulled in possubly by wrongly merged code.

We require dependencies.tsv to document all the top-level packages and their version because golang does not support versioning and notions of stability as debian.

make-release-tarball could check compare the top-level packages with dependencies.tsv and raise an error. The tarball is not releasable, though it can be made. This situation is a regression that is trivially fixed by developers when they are informed.