This adds an update/verify script pair to check `go mod vendor` in the main module. Should we do this in sub-modules too? Fixes #19