Run auto-update script on CI to check for uncommited changes

[kripken]

This would have caught #4534 early.

This just runs the lit tests atm. Those are the ones we update the most so I think it has the most value, and it's a fast suite since it's parallel. Running all the suites would give more coverage, but would almost double our build times which I'm not sure is worth it.