Validate session and scope identifiers

[rnewman]

Datomish refs can point to anything, and in fact aren't restricted — you can point to entids that don't yet exist, or to entids that are part of the schema, etc.

That's error-prone for our purposes in the UAS: we want events to refer to a real session, and sessions to refer to a real scope.

We should validate these, at least in a safe configuration.