Bug 960364: Actually check Cartridge-Vendor value

Check Cartridge-Vendor when installing via URL. Reject it if
it matches any of the reserved vendor name.
(Currently only 'redhat' is reserved.)