charm: add BundleData, parser and Verify method.

This is the start of the bundle specification discussed at https://docs.google.com/document/d/1SF8hTBi6oVbki8V__beNij6wnQU-5cm6PZsy5gf0j_Y
This is something we haven't yet decided. The above logic doesn't allow
an unspecified series - we could easily allow it by calling ParseReference
rather than ParseURL.