Validate the source of a package matches the configuration at restore time

[nkolev92]

The idea here is that the source mapping configuration is currently validated when a package is installed in the global packages folder.

If the package is already in the global packages folder, then we simply don't validate the source mapping.
This work covers that. We'd use the .nupgk.metadata in the global packages folder to perform that check even for already installed packages.

The primary concern here is rollout.