Recursive vendors : check for non-matching versions

[hectorj]

Vendors can have their own vendors

We should check the whole tree and see if there is twice (or more) the same package with different versions, and give the user a warning as it is a potential bug source.

Ideally we'd need to propose some conflict resolution (downgrading/upgrading some packages)