tar: validate imported object set

[cgwalters]

Due to the way ostree HTTP pulls work, we only fetch objects referenced transitively from a commit.

But when importing from a tarball, it's much more of a "push" model. A malicious blob could inject objects not referenced by the commit.

We should keep track of the set of objects starting from the first commit object (after validating it) and fatally error if we find something not in that set.