Option to disallow unused checker suppressions

As code evolves, some suppressions may be added that become unnecessary later one. However, these are easy to miss during refactoring and remains as benign. Unfortunately, this leaves open the possibility of a new error being introduced and uncaught. It can be unfeasible to audit a large code base for unnecessary suppressions after the fact, and generally shouldn't be an error as each tool has its own subset.

It would be nice if ErrorProne allowed its checks to be verified when suppressed. If the suppression is enabled but no error was reported, then the failure it reported. This would be hooked in [ErrorProneScanner](https://github.com/google/error-prone/blob/master/check_api/src/main/java/com/google/errorprone/scanner/ErrorProneScanner.java#L489) and disabled by default.

A scenario is null data flow analysis (https://github.com/uber/NullAway/issues/100) where false positives are suppressed. Then as the code or checker evolves these become potential hazards.