Add option to enforce refs on `whippet deps validate`

[RobjS]

This commit adds an --enforce-refs option that can be passed into whippet deps validate that will cause it to fail if a dependency in whippet.json is missing a "ref" property.

This will facilitate us in enabling automatic plugin updates, as we'll be able to update our shared whippet validation workflow to fail if references are missing, thereby ensuring that all dependencies have a reference and therefore can't be accidentally updated beyond e.g. a major version tag, or a specific pinned version.

Note that like the other checks in whippet deps validate, this does not check whether the reference provided exists and is valid, it just checks one is provided. An implicit check on the validity of the reference itself happens when whippet deps update or whippet deps install is run.

How to test

1. Run the automated test suite with ./script/test
2. Use a symlink or alias so you can run /bin/whippet from this repo (e.g. I have whippet-dev aliased to that file)
3. Clone https://github.com/dxw/wordpress-template, and run your equivalent of whippet-dev deps validate -r on that repo. It should fail
4. Replace the template whippet.json with:

   {
   "src": {
       "plugins": "git@github.com:dxw-wordpress-plugins/"
   },
   "plugins": [
       {"name": "akismet", "ref": "v5"},
       {"name": "advanced-custom-fields-pro", "ref": "v6"}
   ]
   }

5. Run whippet deps update, then run whippet-dev deps validate -r again. Validation should now pass.

• [x] Includes tests (if new features are introduced)
• [ ] Commit message includes link to the ticket/issue
• [x] Changelog updated
• [ ] PR open against dxw's Homebrew Tap to point the Whippet formula to the new version number