validate incoming crate metadata against 'allowed registries'

[danieleades]

the registries that crates are allowed to depend on is set in the Index, and Tree objects.

When a new crate is added, a check should be added to test whether it's dependencies are all from whitelisted registries. If not, return an error.