new rule: validate package.json

[boneskull]

This rule would check that known values in package.json are of the correct format. e.g., engines should be a Record<string,string>; not a string|string[].

I'm sure there's some tool that does this already, but it might be nice to do anyhow, since the use of such a tool does not seem popular.

Zod should be able to handle this.

Also the license field should be a valid SPDX id