Simplify validate_doc_update checks

Since it's no longer allowed to change existing versions, just
throw on that.

Also, add a set of test fixtures for VDU failures to be unit-tested
in isolation.
mv unpublish test from 4 to 5
make deprecation work for individual versions

This has never worked, apparently?
Add deprecation test
Add another vdu test for unpublishing

Related to npm/npm#4705
vdu: ensure that _npmUser matches currently logged-in user