[stable-2.15] nox pip-compile: support check mode

[gotmax23]

Support a custom --check flag to fail if pip-compile made any changes so we can check that that lockfiles are in sync with the input (.in) files.

(cherry picked from commit cb295b1f782bbb0b02af2801b3d0c2337b9a7912)