Improve go mod checks with hack/verify-go-modules.sh

[gman0]

Summary

This PR makes it so that:

• go mod files are checked against the real state of things (with go mod tidy -diff),
• dependencies are in line with k8s repo -- and the script will exit with an error if they are not
  • this concludes the discussion in https://github.com/kcp-dev/kcp/pull/3312#issuecomment-2684510535

/kind feature

Part of: https://github.com/kcp-dev/kcp/issues/3375

Release Notes

NONE