chore: move API compatiblity check to final build step (aws#2911)

Motivation: taking it out of the per-package 'test' step has the
following benefits:

- the build+test cycle is quicker, because we avoid unnecessary
  downloads of old versions of the package from NPM.
- we avoid quadratic complexity of downloads, where packages deep
  in the dependency tree get downloaded over and over again.
- there is a clear moment and location where the check is done,
  which can be easily disabled.

There is still accidental quadratic complexity in the current
implementation which cannot be avoided without updating jsii-diff:
although all downloads are done only once, every package's JSII
assembly is still loaded individually, and all dependencies are
reloaded every time.

Loading assemblies is not as cheap as you'd think, leading many
packages to take multiple seconds to load (~4s per package) and
so the whole process still takes multiple minutes.

build.sh

@@ -55,4 +55,6 @@ echo "==========================================================================
 echo "building..."
 time lerna run $bail --stream build+test || fail
 
+/bin/bash scripts/check-api-compatibility.sh
+
 touch $BUILD_INDICATOR