Refactored `copies` configuration to allow for greater control over when
and which both local build context files and variant artifacts are
copied into the target image.

The new configuration introduces a "local" keyword to signify when a
`copies` entry should apply to the files from the local build context as
opposed to files from another variant's image during a multi-stage
build.

  variants:
    build:
      copies:
       - from: local
         source: ./src
         destination: .

Note that with this change, the user must now explicitly define whether
_any_ files should be copied in from the local build context. None will
be copied in by default.

To help keep configurations succinct, especially considering this new
requirement, and to approximate the old `copies: variant`, a shorthand
format and sane defaults for `source` and `destination` (depending whether
`from` is "local" or a variant name) were implemented.

  variants:
    build:
      copies: [local]
    development:
      copies:
       - from: build
       - from: local
         source: ./config.dev.yaml
         destination: ./config.yaml

The shorthand:

  copies: [ref, ...]
  # is equivalent to
  copies: [{ from: ref }, ...]

And the following defaults are used when no `source` and `destination`
are specified.

  copies:
   - from: local
   # defaults to
   - from: local
     source: .
     destination: .

  copies:
   - from: variant
   # defaults to two entries
   - from: variant
     source: /srv/app # the lives.in dir
     destination: /srv/app
   - from: variant
     source: /opt/local # the shared lib dir
     destination: /opt/local

Bug: T211625
Change-Id: I4c4217905afc0762b6bd66ed594d43cc0486e3e2

Uses the github.com/ghodss/yaml library to convert YAML to JSON before
unmarshaling for the purposes of supporting YAML and JSON input while
converting to only support JSON internally.

Bug: T207694
Change-Id: I00668014907e9ea54917f5d5067cac08d0668053

Summary:
Introduced a `version` config field that must be specified and match
`config.CurrentVersion`.

Changed `config.ReadConfig` to use `yaml.UnmarshalStrict` to ensure that
errors are surfaced when unknown/bad fields are present in the given
YAML config. A smaller `config.VersionConfig` is now unmarshaled first
to prevalidate the new `version` field before the entire config is
parsed.

Fixes T191460

Test Plan:
Run `go test ./...`. Run `blubber` against some configuration containing
invalid fields and ensure that it surfaces a YAML error.

Reviewers: thcipriani, demon, hashar, mmodell, mobrovac, #release-engineering-team

Reviewed By: thcipriani, #release-engineering-team

Tags: #release-engineering-team

Maniphest Tasks: T191460

Differential Revision: https://phabricator.wikimedia.org/D1021

Summary:
It occurred to me while looking at code in another patch that there is
no need to have this function be public.

Test Plan: `go test ./...`

Reviewers: dduvall, #release-engineering-team

Reviewed By: dduvall, #release-engineering-team

Tags: #release-engineering-team

Differential Revision: https://phabricator.wikimedia.org/D1012

Summary:
Implements a rough interface for validating configuration against
arbitrary policy rules. Policies are provided as YAML and passed via the
command line as file paths or remote URIs.

The format of policies is:

    enforcements:
      - path: <path>
        rule: <rule>

Where `<path>` is a YAML-ish path to a config field and `<rule>` is any
expression our config validator understands (expressions built in by the
validator library and custom tags defined in `config.validation.go`).

Example policy:

    enforcements:
      - path: variants.production.base
        rule: oneof=debian:jessie debian:stretch
      - path: variants.production.runs.as
        rule: ne=foo
      - path: variants.production.node.dependencies
        rule: isfalse

Command flag parsing was implemented in `main.go` to support the new
`--policy=uri` flag and improve existing handling of `--version` and the
usage statement.

Test Plan: Run `go test ./...`.

Reviewers: thcipriani, demon, hashar, mmodell, #release-engineering-team

Reviewed By: thcipriani, #release-engineering-team

Tags: #release-engineering-team

Differential Revision: https://phabricator.wikimedia.org/D999

Summary:
Implemented a validation system using the
`github.com/go-playground/validator` package, extending it with custom
validation tags, and implemented translation of validation errors into
somewhat human-friendly messages.

Fixes T175186
Depends on D845

Test Plan: Run the unit tests and try running blubber against some bad config.

Reviewers: thcipriani, hashar, Jrbranaa, Joe, #release-engineering-team, mobrovac

Reviewed By: thcipriani, #release-engineering-team

Tags: #release-engineering-team

Maniphest Tasks: T175186

Differential Revision: https://phabricator.wikimedia.org/D868