allow to filter tarball validation by a URL substring

When validating a new GHC/Cabal/HLS release, it is convenient to just check specific tarballs (especially if the unchanged tarballs are not cached). Filtering by a URL substring seems to be suited for this.

An example in the context of !55 (merged):

cabal run exe:ghcup-gen -- check-tarballs -f ghcup-0.0.4.yaml -u 9.0.1-rc1

Also, use nubOrd for linearithmic instead of quadratic complexity (requires derivation of two Ord instances). Can change if this is out of scope.