WIP: First cut at input validation for Kubelet

* Add some util functions for basic validation
* Spec api fields more tightly
* Break a dep from util -> api, so I can do the reverse
* Add functions to validate structures
* Call those functions when running manifests

This does not validate as it unmarshals YAML or JSON because I want to be able
to validate structures that come from other inputs without forcing them to be
YAML.

This does not handle all api structures - I am not familiar wnough with the
rest to spec them this tightly - I hope someone else can do that.

There are a number of open questions, marked "FIXME".  Please offer feedback
or opinions.
Sorry, I can't read-- commit != comment. Coffee hadn't kicked in yet... :)

Distinct pods that both expose port 80, for example, can't be located on the same machine (currently). It's the job of the scheduler to keep this from happening. This is a quasi bug which may or may not change in the future and not really what I was referring to.

My point--and I think we're on the same page--is that a single pod may not have multiple containers all trying to expose the same port, because the model is ip-per-pod: you can't have a pod where container A has apache servicing port 80 and container B has nginx servicing port 80. You can't put those two things in the same container because they conflict, and you can't put them in the same pod, either, because they still conflict.