Validate dependency id (name + org) matches the manifest in a repo

[jefferyshivers]

Currently, we do validate that a manifest exists in a given repo when it is a dependency. But we don't validate that the given id is actually matched with the properties in the manifest.

For example, running protop sync in Project B currently works without any errors/warnings that the id of a dependency (Project A) doesn't match what's in the manifest:

Project A's manifest:

{ "name": "foo", "organization": "bar" }

Project B's manifest:

{ 
  "dependencies":  { 
    "invalid/test": "gh:foo/bar"
  }
}

We should probably at least provide a warning log that there is a mismatch, and optionally a flag (e.g. protop sync --valid) to exit with an error.