force CVS_RSH=ssh in the check-updates target

It worked fine without it in the CVS that shipped by default with 10.6,
but this seems to not be the case with CVS from macports in 10.9.