Feat validate subcommand

[willmurphyscode]

Migrates many of the gate.py in multiple repos to a new subcommand validate, which takes a result set of reference and candidate changes, a validation configuration (within yardstick.yaml) and when invoked gives a pass/fail indication.

Fixes #126

TODOs

• fix max year use
• fix max year calculation (if everything is none, there is no max)
• assert that all of allowed_namespaces are observed (renamed to expected_namespaces?)
• Deal with Vunnel's requirement to assert which namespaces are present in the DB without requiring that they be present in any match (or else make Vunnel do this outside the context of yardstick validate)
• clean up false starts
• unit tests
• wire in logging, especially for things like the namespace filter
• open a grype PR that switches grype to use this branch of yardstick, and updates grype to use the new functionality. DONE: chore: switch to yardstick validate from custom gate.py grype#2090
• Branch off that grype branch to show validations fail when bug is introduced in grype matching
• ditto for grype-db, approach 1: wip: switch to invoking yardstick validate from within grype-db python grype-db#371
• grype-db approach 2 (popen or invoke, instead of calling the python methods): use yardstick validate: subprocess-based proof of concept grype-db#372 - probably not this approach
• grype-db approach 3 PR - use click invoke, make db.ValidateDB config a list. Chore use click invoke yardstick grype-db#373
• Branch off grype-db approach 3 PR to show that validations fail when a bug is introduced
• ditto for vunnel: chore: switch to new yardstick validate vunnel#672
• Branch off the vunnel PR branch to show that validations fail when a bug is introduced

[willmurphyscode]

This is supposed to return the same string as the tool version that's in .tools on a ScanResult, but nothing enforces this and it doesn't seem to always be true.