Add function to check Manifest.toml health?

[nickrobinson251]

If a repository is an application that commits a Manifest.toml, then there are various things you may want to check, similar to how we can check the Project.toml has compat etc.

Some ideas:

• No deps are tracking a repo directly (no repo-rev/repo-url)
  • alternatively, no deps are tracking a branch of a repo, but are at least fixed to a particular commit or tag (e.g. repo-rev should match [some regex TBD])
• No deps are pinned
• No deps are tracking a path
  • alternatively, only a certain path is allowed (e.g. like packages/Foo not ../../Foo)
• the julia_version matches the version being used to run the tests
  • alternatively, the julia_version matches up to at least the minor version (e.g. 1.9.3 and 1.9.2 both allowed, but 1.8.5 would fail)

[lgoettgens]

I honestly do not see any serious use-case to commit a top-level Manifest.toml in the first place.

[nickrobinson251]

if the repo is for building an application, rather than a package. For example, if you are using something like PackageCompiler.jl to create an "app", i.e. an executable, then you may want to control the exact set of dependencies being compiled into the image.

[lgoettgens]

Hm, okay, seems reasonable.