Add validation when processing pod manifests from a URL.

(The real reason we can't do this: it would break our container VM image.)

What we should do here (eventually?) is first attempt to api.Decode. If we get an api.Pod or api.PodList, great, we're done. But then we need to fall back to this behavior to be backwards compatible.