Check command

[jalil-salame]

I'd like an agenix --check command for CI, to ensure fetched keys (e.g. https://github.com/jalil-salame.keys) are not out of date in the recipient files.

Running agenix --rekey in CI is not an option:

1. I don't want CI to have access to the secrets
2. agenix --rekey changes all files even if unnecessary.
   This is because age uses a nonce which is generated when you call encrypt, calling --rekey regenerates this nonce and causes all the data to change.