CI: Test that any bump to changelog has a corresponding tag
Prevents forgetting to sign the tag, which is currently done out of band and independently of review.
To run: just run the shell line in the new job.
To test: change the number in parentheses in the first line of debian/changelog
.