Add api/validator submodule

[elezar]

This change pulls the validation logic from pkg/cdi into a separate go submodule. This allows clients to implement composable validation without depending on the logic required to modify the OCI runtime specification.

See, for example, #233 where the logic for writing CDI specs is pulled into a separate go submodule with a smaller set of dependencies.