Verify checksums for pull requests from other people

This has the CI step verify the checksums for URLs that might have been
added or edited to build definitions in a pull request.
Improve `script/mirror` argument handling

Now supports `-h|--help`.
Merge branch 'pr-checksum'