[ExportVerilog] Check given `hw.verilogName` is a valid verilog word

`ForceNameAnnotation` adds `hw.verilogName` to force the emitter to use annotated names but currently the emitter doesn't check the validity of the given names. Even though it's users' responsibility to use 1hw.verilogName` but it's better for the emitter to reject invalid verilogs at the compile time, e.g:
* a given name conflicts with verilog keyword
* a given name conflicts with other names

```scala
circuit Foo: %[[
{
"class": "chisel3.util.experimental.ForceNameAnnotation",
"target": "~Foo|Foo>bar",
"name": "wire"
},
{
"class": "chisel3.util.experimental.ForceNameAnnotation",
"target": "~Foo|Foo>bar1",
"name": "bar"
},
{
"class": "chisel3.util.experimental.ForceNameAnnotation",
"target": "~Foo|Foo>bar2",
"name": "bar"
}
]]
module Bar:
input in: Clock
output out: Clock
out <= in

module Foo:
input in: Clock
output out: Clock

inst bar of Bar
bar.in <= in
out <= bar.out
inst bar1 of Bar
bar1.in <= in
inst bar2 of Bar
bar2.in <= in

out <= bar1.out

```

`firtool foo.fir` produces following verilog which is clearly invalid.

```verilog
Bar wire (
.in (in),
.out (/* unused */)
);
Bar bar (
.in (in),
.out (out)
);
Bar bar (
.in (in),
.out (/* unused */)
);
```

Start at ForceNameAnnotation handling in firtool's Verilog emitter and trace how the annotated name reaches ExportVerilog. Verify the existing output against Verilog keywords and duplicate names, then add coverage for both invalid cases; done means firtool rejects them at compile time instead of emitting invalid Verilog.

Written by the indexing model from the issue text.