CI: Test that any bump to changelog has a corresponding tag

Prevents forgetting to sign the tag, which is currently done out of band and independently of review.

debian/check_release.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+
+"""Checks tag before release.
+Feed it the first changelog line, and then all available tags.
+"""
+
+import re, sys
+tag = "v" + re.findall("\\((.*)\\)", input())[0]
+if tag not in map(str.strip, sys.stdin.readlines()):
+    raise Exception("Changelog's current version doesn't have a tag. Push the tag!")