publish: Move dependency validation to validate_dependency() fn

[Turbo87]

This moves the dependency validations from the serde Deserializers to a new validate_dependencies() fn. This is in preparation for moving this code away from using the JSON metadata and reading the dependencies from the embedded Cargo.toml file instead.