Add `fail_on_changes` to toxgen. The idea is that the script will now
have two modes:

- **Normal mode** (when `fail_on_changes` is `False`) that is used to
actually generate the `tox.ini` file. This [will
be](#4050) run in a
cron job in CI and create a PR with the updated test setup.
- The newly added **fail-on-changes mode** (when `fail_on_changes` is
`True`) that is used to detect manual changes to one of the affected
files without updating the rest (e.g. making a manual change to
`tox.ini` without updating the `tox.jinja` template). This will be run
in CI similar to the `fail_on_changes` check of `split-tox-gh-actions`.

The problem with detecting manual changes is that if we just reran the
script on each PR, chances are it would pull in new releases that are
not part of the `tox.ini` on master, making the file look different from
what was committed as if it had unrelated manual changes.

To counteract this, we now store the timestamp when the file was last
generated in `tox.ini`. We use this in fail-on-changes mode to filter
out releases that popped up after the file was last generated. This way,
the package versions should be the same and if there is anything
different in `tox.ini`, it's likely to be the manual changes that we
want to detect.

Closes #4051