Makes sure that Python headers always come first (if implicitly)

Also adds a script to check this and a CI run to ensure this.

NOTE(seberg): If that script/CI run becomes problematic and not super easy to fix maybe we shouldn't worry too much about even deleting it again. It's wortwhile for sure, but I am not sure it is worthwhile to spend too many cycles making pretty.