Improved formula attribute validation

The initializer for Formula does a number of validations, but it does
them in a weird order, and some attributes aren't validated under
certain circumstances. This became even more of a mess when most
software package attributes were moved into the SoftwareSpec class.

This commit removes the last vestiges of storing these attributes as
instance variables. In particular, it eliminates #set_instance_variable
and #validate_variable, replacing them with methods that operate on
SoftwareSpec instances, and generate more useful errors.

Doing these validations unconditionally in the initializer means we bail
out much earlier if the formula has invalid attributes or is not fully
specified, and no longer need to validate in #prefix or #brew.
Allow "devel-only" formulae

It seems only natural that this should be possible, or at the very
least, it should not result in calling methods on nil.
Add tests for formula spec selection

These tests document the relative precedence of the stable, bottle,
devel, and head specifications, and the conditions that can influence
which is selected (e.g. command-line flags).
Raise a useful exception for incomplete formulae