package: use a central verification-metadata file

This lets us have better control over which dependencies are verified,
as changes to runelite-client's dependencies cause all Hub plugins with
pinned deps to fail, as the new transitive deps aren't pinned. Moving
this file into this repo not only lets us update it in these situations,
but also means individual plugin authors don't need to touch Gradle's
verification and all of it's associated pains. This also allows plugins
to pull a dependency that another plugin pulls already with no extra
work.

.github/workflows/build.yml

@@ -28,11 +28,12 @@ jobs:
         path: |
           ~/.gradle/caches/
           ~/.gradle/wrapper/
-        key: package-2.0.3
+        key: package-2.0.4
     - name: prepare
       run: |
         pushd package
         ./gradlew --build-cache prep
+        ./gradlew --build-cache --project-dir verification-template :verifyCore
         popd
     - name: build
       env:
@@ -79,7 +80,7 @@ jobs:
         path: |
           ~/.gradle/caches/
           ~/.gradle/wrapper/
-        key: upload-2.0.3
+        key: upload-2.0.4
     - uses: actions/download-artifact@v2
       with:
         name: manifest_diff