Add validation checks to protect injection into top level

[cmungall]

Continuing discussion from #463

Experiment here: #464 (I didn't merge, so it's possible that this was actually safe)

Currently it seems possible to inject anything into the top level. Of course we'd never merge such a request but for long term maintenance we should make this a check.

First we should define the rules of what are allowed on the top level. I can see a spectrum:

1. myont.{obo,owl,json}[.gz]
2. myont.*
3. myont-.

I would opt for 2. ie. people "own" everything after a period or slash