Add a flag for performing a sanity check after enforcing

[jmickelin]

We ran into a couple of issues where BEC reported that it was updating some settings, but Bitbucket (for various reasons) silently throwing away those changes. In order to detect when this happens in the future, we are considering changing our pipeline to run BEC in verify-mode again after enforcing, sort of like a sanity check.

Suggestion: The possibility of this happening (however rare) is not clear from the documentation I have read, but it can have disastrous consequences, say if some access permissions are not successfully enforced (as was the case for us). Adding a new flag -s, --sanity-check that can be used together with -e, and which causes the program to run a final verification after processing each repository would both highlight the possibility of this edge case and provide a more ergonomic solution than running the command twice.

[jesperes]

It seems like this could be accomplished by rerunning bec without the -e option afterwards.