ci: guard against a stale inspektor-gadget replace pin (#929)

Ports armosec/private-node-agent's scripts/check-inspektor-gadget-pin.sh:
that repo hit a real incident where a go.mod replace pin for
inspektor-gadget/inspektor-gadget was repointed at an unmerged branch
commit on kubescape/inspektor-gadget for a "stack immediately" workflow,
and the re-pin to the merged SHA was forgotten before merge (see that
repo's commit d358344, follow-up to its PR #540). This repo vendors the
same fork via the identical replace pattern, so it is exposed to the same
mistake.

Adds a PR check (triggered on go.mod changes) that fails on either signal:
a NOTE-style "pending re-pin" comment above the replace line, or the
GitHub compare API confirming the pinned commit is not an ancestor of
kubescape/inspektor-gadget:main. Runnable locally via `make check-ig-pin`.