builder: check Org/OU ARNs during prepare

[lbajolet-hashicorp]

When a builder accepts organisation or organisational unit ARNs as part of its config, we don't actually validate that the format matches what AWS accepts, leading to confusion among our users.

This commit checks that the provided ARNs match the expected format before running the build, and tries to provide information on what to change in the configs so they succeed later.

Related to #492