Improvements to formula validation and spec selection

This is the result of #18579, see that for background.

    Improved formula attribute validation

    The initializer for Formula does a number of validations, but it does
    them in a weird order, and some attributes aren't validated under
    certain circumstances. This became even more of a mess when most
    software package attributes were moved into the SoftwareSpec class.

    This commit removes the last vestiges of storing these attributes as
    instance variables. In particular, it eliminates #set_instance_variable
    and #validate_variable, replacing them with methods that operate on
    SoftwareSpec instances, and generate more useful errors.

    Doing these validations unconditionally in the initializer means we bail
    out much earlier if the formula has invalid attributes or is not fully
    specified, and no longer need to validate in #prefix or #brew.

    Allow "devel-only" formulae

    It seems only natural that this should be possible, or at the very
    least, it should not result in calling methods on nil.

    Add tests for formula spec selection

    These tests document the relative precedence of the stable, bottle,
    devel, and head specifications, and the conditions that can influence
    which is selected (e.g. command-line flags).

    Raise a useful exception for incomplete formulae