Add CLI for managing `sensitive_packages`