kernels: split out digest validation validation and raise on two different kernels with the same ID

[danieldk]

This change splits out digest validation into a separate validator, DigestValidator. We also separate out the receipt caches for digest and signature validation. This allows us to unconditionally enable digest validation and raise when digest validation fails.

Building on this, we also update the importing code to raise when two different kernels have the same kernel id.

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.