Add pre-publish validation that ensures shared tag manifests include all expected platforms defined by manifest.json

[dagood]

Currently, an official build might publish a partial manifest for a few reasons:

• Path-filtered builds can overwrite shared tags with partial manifest lists #2107
• Historical: Write build matrix variables directly to stdout #2125
  • Likely cause of outage: go-images shared manifest tags missing linux/amd64 after partial platform publish microsoft/go#2313

I can't think of a reason an official build should ever publish a shared tag that doesn't include all its platforms defined in the manifest.json. As far as I can tell, this always indicates a problem. To protect against regressions, it makes sense to me to explicitly check rather than relying on the logic along the way. Failing the build is vastly preferable to pushing out bad tags.

A dev build, on the other hand, might want to publish a shared tag that only includes some platforms, for avoiding waste, improving end-to-end performance, or some specific test. So, I imagine it'd have to be conditional, or simply opt-in.