Add registry validators (#350)

Fixes #96

## Motivation and Context

See #96

## How Has This Been Tested?

Has some unit and integration tests, still needs proper testing of the
different registry types

## Breaking Changes

Yes, new package uploads will need extra verification

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

pkg/model/types.go

@@ -12,12 +12,12 @@ const (
 // Package represents a package configuration
 type Package struct {
 	// RegistryType indicates how to download packages (e.g., "npm", "pypi", "oci", "mcpb")
-	RegistryType string `json:"registry_type,omitempty"`
+	RegistryType string `json:"registry_type" minLength:"1"`
 	// RegistryBaseURL is the base URL of the package registry
 	RegistryBaseURL string `json:"registry_base_url,omitempty"`
 	// Identifier is the package identifier - either a package name (for registries) or URL (for direct downloads)
-	Identifier           string          `json:"identifier,omitempty"`
-	Version              string          `json:"version,omitempty"`
+	Identifier           string          `json:"identifier" minLength:"1"`
+	Version              string          `json:"version" minLength:"1"`
 	FileSHA256           string          `json:"file_sha256,omitempty"`
 	RunTimeHint          string          `json:"runtime_hint,omitempty"`
 	TransportType        string          `json:"transport_type,omitempty"`