Raise when a lock file contains conflict markers

This matches bundler behavior, but not its exception message (since we
don't know if the user is using git).
Extract dependency validation from #validate

The #validate method was too big, and still is too big.
Warn for open-ended dependencies

This assumes the simple case of a single requirement in the dependency.
While it detects compound open-ended dependencies, the messaging it
provides is probably wrong.

You don't want to do that anyway, so if someone complains we should
instead warn about compound open-ended dependencies first.