mk/{package,publish.sh}: Do extra last-instant dirty repo checks.

`--allow-dirty` doesn't allow us to be as granular as we'd like;
see rust-lang/cargo#9398 (comment).

This isn't foolproof but it gets us closer to what we want.

The new `mk/publish.sh` is a step towards more robust publishing with
tagging, etc.

mk/package.sh

@@ -12,4 +12,8 @@ fi
 cargo clean --target-dir=target/pregenerate_asm
 RING_PREGENERATE_ASM=1 CC_AARCH64_PC_WINDOWS_MSVC=clang \
   cargo build -p ring --target-dir=target/pregenerate_asm
+if [[ -n "$(git status --porcelain -- ':(exclude)pregenerated/')" ]]; then
+  echo Repository is dirty.
+  exit 1
+fi
 cargo package -p ring --allow-dirty

mk/publish.sh

@@ -0,0 +1,9 @@
+set -eux -o pipefail
+IFS=$'\n\t'
+
+# Make sure the current tree isn't dirty other than what's in pregenerated/.
+if [[ -n "$(git status --porcelain -- ':(exclude)pregenerated/')" ]]; then
+  echo Repository is dirty.
+  exit 1
+fi
+cargo publish -p ring --allow-dirty