Use GitHub actions to check the SHAs and validity of URLs

[seanbudd]

What happens if an URL is not available anymore? E.g. deleting a GitHub release by mistake.

From the add-on author point of view, I guess that this version should be revoked and a new should be made. But what if the author do not revoke it? May an add-on be revoked due to a permanently broken link (or a modified SHA)?

Originally posted by @CyrilleB79 in #109 (comment)

A GitHub action should check the SHAs and ensure the URLs work for all versions of add-ons hosted in the add-on store.

[CyrilleB79]

Also, if possible, the check should be robust to temporary URL unavailability in order to avoid revoking add-ons by mistake.

Maybe there should not be auto-revokation but only a mail sent to NVAccess or add-on store maintenance team so that the situation is handled by humans.

[XLTechie]

Could a failing URL generate a listing in a state file, that is checked against on next day's run, and a counter incremented if still failing? After five checks fail (or whatever number of days is thought good), then the listing is considered expired, and a new version must be issued? Meanwhile, if the check fails for two consecutive runs, a notice could be sent to a human in case manual interaction should be done before the automatic process disables the listing or whatever?

[seanbudd]

It's probably also worth running full schema validation on all add-ons retrospectively to pick up any add-ons which were merged before certain schema requirements were made.