Validate a metadata payload

Serializer for POST /metadata/validate.

Same shape and validation rules as the write serializer but without fields tied to persistence (e.g. source_identity). Used by clients that want to fail fast on a metadata payload before they have a package slug to attach it to.