Move translation and transform constructs to own modules
s/append_to_key/append_to/
Split out validator for roles

Translation currently performs validation, but we'll want to validate
input independent of translation/transformation for API calls.
Manifest module *is* a validator
Drop ugly ~defaults~ feature from _translate

The function already takes a destination parameter that can be used to
inject defaults.
It turns out ':' is not allowed in these names...

Still #2.