Check that vendoring patch is correct

[dagood]

It's easy for a mistake in the vendoring patch to slip through. There are a few types of test we could add:

• Make sure the patch only modifies files under src/vendor/.
• Make sure the patch matches the result of a freshly performed go mod vendor exactly. (Not just the repo state, the patch itself--no extraneous adds.)

A tricky part of an approach that actually applies patches is identifying the commit in the repo associated with the vendoring patch. Matching against the commit title could work, but might be fragile. Something more stable could be to use a patch number 50 command to get a fixed number, then CI uses that number to selectively apply pre-vendor patch files and also the vendor patch individually.