Improve change auditing

[gastaldi]

@gastaldi, do you think it's worth updating the metadata with an extra field to say 'this has been patched' when we do the patch? I'm imagining myself staring at what's coming back from the registry, and then staring at what's in github, and scratching my head trying to figure out why they don't match. I think including a full audit trail of what-changed-and-when in the metadata of the extension would be overkill, but maybe some indicator that this was patched data would be useful.

Originally posted by @holly-cummins in #176 (comment)