return version value from download_source should be validated

[dhellmann]

Plugins return a version as a string. We need to make sure the return values are valid Version representations and should fail if they are not.

We could change the API to require returning a Version, but that would be a hassle for existing implementations. We could make that optional.

At the very least we should pass the return value to Version and let it throw an exception to report any errors.

[shubhbapna]

Looks like default_download_source is already returning a version object and is already doing this validation then. It gets the version from: https://github.com/python-wheel-build/fromager/blob/main/src/fromager/sources.py#L138

and in resolve_dist, the candidate.version field is being returned which is already a Version: https://github.com/python-wheel-build/fromager/blob/main/src/fromager/resolver.py#L44

We will want to fix this mismatch