Validate external inputs with Zod

[smorimoto]

Summary

• validate recursive opam dependency output before creating dependency snapshots
• validate runner environment and opam repository inputs without type assertions
• derive TypeScript types from the Zod schemas and update the bundled actions

Testing

• yarn lint
• yarn workspace @ocaml/analysis exec tsc --noEmit
• yarn workspace @ocaml/setup-ocaml exec tsc --noEmit
• yarn build
• runtime checks for valid and invalid opam output, repository mappings, and runner environment values