Reject packages that don't specify an upper bound

We're seeing an increased number of breakages due to packages not adding upper bounds (see e.g. https://github.com/haskell/HTTP/issues/55). `cabal upload` ought to reject such packages (or at least give a strong warning). This will not fix the packages that are already uploaded without bounds*, but at least this will help prevent the issue in the future.

*@dcoutts is working on post facto .cabal file editing to help with that problem.

Start by locating the cabal upload command and its package validation path, then inspect any related tests. Define how missing upper bounds are detected and whether the result is rejection or a strong warning; done means packages without upper bounds are handled consistently before upload.

Written by the indexing model from the issue text.