CI: Run mypy with --check-untyped-defs

All typing errors found with --check-untyped-defs have been fixed, so let's make mypy stricter now to avoid regressing this.

Depends on and thus includes !2425 (merged). Once it's merged, this can be undrafted and merged.

.ci/mypy.sh

@@ -11,4 +11,4 @@ fi
 set -x
 
 pip install --break-system-packages --no-warn-script-location mypy
-python -m mypy --color-output pmbootstrap.py
+python -m mypy --color-output --check-untyped-defs pmbootstrap.py