Add a validate-vendor script

Makes sure that if ./hack/vendor.sh has been updated, it has been used
to update the vendor folder.

Signed-off-by: Vincent Demeester <vincent@sbr.pm>