Add crate-ID validation

[alexhambley]

Issue

Right now, Crate IDs are accepted unchecked and flow into object keys and local paths. This is error-prone (the old prefix match breaks when an ID contains .zip) and unsafe (../ enables path traversal).