move `model.bom.Bom.validate()` to `validation.models`

[jkowalleck]

now that a package validation was established via #432,
t should be possible to move the data model validation there, too.\

data model validation is getting more and more complex #453
and should be encapsulated and could be devided.

[saquibsaifee]

This is just moving Bom.validate() to validation.model as-is and update the references, or do you want it refactored into smaller functions?

[jkowalleck]

This is just moving Bom.validate() to validation.model as-is and update the references, or do you want it refactored into smaller functions?

existing public API shall be deprecated and something more advanced shall be provided.
details may be discussed

[saquibsaifee]

Opened a draft to get something going on.

I've implemented a ModelValidator that returns an iterable of errors (so you can collect multiple issues instead of failing on the first one). It's side-effect free - just validates, doesn't mutate anything.

@jkowalleck I noticed Bom.validate() was marked "deprecated without replacement," but it does two things - normalization (
register_dependency calls) AND validation. For backward compatibility, I kept both in the deprecated method. The new ModelValidator only validates. How do you want to handle this going forward?

1. Keep the current approach (normalization stays in deprecated Bom.validate())
2. Remove it completely (breaking change) and make validation optional with a parameter