More automation for updating dependencies

- Convert update checks in check.sh to mechanical updates.
  - Use https://www.updatecli.io/ for now, which is not as
    full-featured as renovatebot or dependabot, but I found it easier
    to plug arbitrary shell scripts into.
- Add updaters for
  - ubuntu-latest-lts (which is similar to GitHub Action's "ubuntu-latest").
  - FreeBSD image used in Cirrus (requires "gcloud auth login" for now,
    see https://github.com/cirruslabs/cirrus-ci-docs/issues/1315)
  - littlecheck and widecharwidth
- Update all dependencies except Cargo ones.
- As a reminder, our version policies are arbitrary and can be changed
  as needed.
- To-do:
  - Add updaters for GitHub Actions (such as "actions/checkout").
    Renovatebot could do that.

build_tools/version-available-in-debian.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euo pipefail
+
+channel=$1 # e.g. stable, testing
+package=$2 # e.g. rustc, sphinx
+
+codename=$(
+    curl -fsS https://ftp.debian.org/debian/dists/"${channel}"/Release |
+    grep '^Codename:' | cut -d' ' -f2)
+curl -fsS https://sources.debian.org/api/src/"${package}"/ |
+    jq -r --arg codename "${codename}" '
+        .versions[] | select(.suites[] == $codename) | .version' |
+    sed 's/^\([0-9]\+\.[0-9]\+\).*/\1/' |
+    sort --version-sort |
+    tail -1