bin/importmap verify compares vendored files with remotes

[martinemde]

In rubygems/rubygems.org#4396 we ran into the problem of verifying the provenance of files in vendor/javascript. This is a blocker for us using importmap-rails at this time.

In this PR, I attempted to add a process that could be run in CI that would download and verify that the files that are vendored are actually what would be downloaded fresh today.

I assume there are some edge-cases, or even really obvious cases, that I didn't handle in this PR. I wanted to start gathering feedback so I know if this is the right solution.

[Caleb-T-Owens]

Heads up - PR will conflict with #235.

I'm happy to resolve the conflicts despite which may get merged first

[martinemde]

@Caleb-T-Owens Thanks! I'd be happy to work with you on it assuming this PR is accepted.

[martinemde]

For reference, here is our importmap.rake where I implemented this verify step in rubygems.org.

Current output:

$ rake importmap:verify
Verifying packages in vendor/javascript
Verifying "@rails/ujs" download from https://ga.jspm.io/npm:@rails/ujs@7.1.3/app/assets/javascripts/rails-ujs.esm.js
Verified  "@rails/ujs" at vendor/javascript/@rails--ujs.js
Verifying "clipboard" download from https://ga.jspm.io/npm:clipboard@2.0.11/dist/clipboard.js
Verified  "clipboard" at vendor/javascript/clipboard.js
Verifying "jquery" download from https://ga.jspm.io/npm:jquery@3.7.1/dist/jquery.js
Verified  "jquery" at vendor/javascript/jquery.js
Verifying "stimulus-rails-nested-form" download from https://ga.jspm.io/npm:stimulus-rails-nested-form@4.1.0/dist/stimulus-rails-nested-form.mjs
Verified  "stimulus-rails-nested-form" at vendor/javascript/stimulus-rails-nested-form.js
Verifying "@hotwired/stimulus" download from https://ga.jspm.io/npm:@hotwired/stimulus@3.2.2/dist/stimulus.js
Verified  "@hotwired/stimulus" at vendor/javascript/@hotwired--stimulus.js
All pinned js in vendor/javascript verified.

I think the output could be cleaned up a bit.

[simi]

Is there anything we can do to move this forward? 🤔