Add an automated check to ensure package reports are never removed.

[calebbrown]

A malicious package report should never be deleted from the repository.

False positives, must be marked as withdrawn. This allows people to see that a previously marked package was actually malicious.

To enforce this, a check should be added to ensure a package in the dataset is never removed from the dataset.