Add VERIFY_CHECK and use CHECK macros more

Add a new macros DEBUG_CHECK (similar to assert) and VERIFY_CHECK (which only performs CHECK() when -DVERIFY is set), and move those macros to util.h.

All internal asserts are converted to VERIFY_CHECKs, all external input validation are converted to DEBUG_CHECKs.