Pinning apidiff to a specific version shouldn't be necessary because, if past
experience in klog holds true, the latest version just works. This way we don't
have to remember to bump up the revision.
The downside of using "latest" is that a compromise of that version would give
an attacker the ability to run code in the CI and on developer machines.
apidiff can be invoked for a single internal package or iterate over
everything, including staging. The base to compare against can be specified via
-r (similar to verify-golangci-lint.sh), with the default the base revision on
master (similar to -a in verify-golangci-lint.sh).
