config: add expression.validate

It verifies AST invariants:

* comparison operators have to be applied to version literals and
  variables
* logical operators have to be applied to boolean expressions
* the root AST node should be a boolean expression

It also verifies variables:

* variables are referenced by the given expression have to be provided
* provided variables have to contain a three component versions

Part of #9452

NO_DOC=It is a supplementary module for config's conditional section
       predicates. To be documented in the last commit of the series.
NO_CHANGELOG=see NO_DOC