Dependency keys now have validation via Alias newtype.

[u-train]

Relevant Changes

• World Peace has been achieved.
  • Restrictions on Alias: must be a valid Lua identifier (alphanumeric ASCII + underscores + no leading digit) and not be harmful to the file system.
• The Resolve graph from resolution now uses Alias to link dependencies together instead of strings.
  • This is a breaking change to the public API.
• The lock file now uses Alias to name dependencies instead of strings.
  • This means old lock files will now be validated when they weren't before. There's an infinitesimal chance that someone will be uppity about this.
• test_packages got alias adoption, it's happy, it's internal.
• All tests are passing, yay!