Add validating reader

[mikeminutillo]

While trying to remove TotalThroughput we discovered a point of friction with the way signatures are being validated.

The way this was happening is as follows:

1. Deserialize the json into an in-memory object (SignedReport). This object had two fields, Signature and ReportData.
2. Reserialize the ReportData and use that to calculate the expected signature
3. Compare the expected signature against the Signature

This means that any change to the ReportData that would affect the way it is serialized, would break the signature validation logic. This includes removing fields, renaming fields (even if we could handle the way old reports were deserialized), or adding fields that have a default value.

To resolve this we added a class that validates the signature while it reads the report data. It does this by:

1. Parsing the raw json into a JsonDocument
2. Gets the UTF8 bytes from the report data element
3. Gets the Signature
4. Calculates the expected signature from the result of step 2 (guaranteed to be what was in the original json)
5. Deserializes the report data element into an in-memory representation

This means we can validate the signature, even without having the in-memory representation if we need to.

The downside to doing it this way is that we have to validate the signature when we load the raw json into memory. We cannot load a SignedReport into memory and then validate it's signature separately. As we only do this in our internal tools, and we always validate the signature shortly after loading it, that trade-off seems acceptable.