VRT capability validator: centralize post-parse pre-read gate (#2342 work item)

[brendancol]

Sub-task of #2342.

Add a centralized validate_vrt_capability(parsed) that runs after VRT parse and before any read executes. Both read_vrt in _vrt.py and the open_geotiff(..., .vrt) path in _backends/vrt.py need to call it so unsupported VRT features fail identically at both entry points.

validate_parsed_vrt already exists in xrspatial/geotiff/_vrt_validation.py and covers transform orientation, dtype, pixel size, mixed-nodata, CRS, SrcRect/DstRect sanity, and part of the resample algorithm case. This work extends it to cover the remaining gaps and wires the internal _vrt.read_vrt entry point through the same gate. Today only _backends/vrt.read_vrt calls the validator, so a direct call into _vrt.read_vrt skips it.

Detection scope:

• Nested VRTs: a .vrt referenced as a SourceFilename inside another VRT. Reject.
• Warped VRTs: <VRTRasterBand subClass="VRTWarpedRasterBand"> or a <GDALWarpOptions> block anywhere in the tree. The current parse step catches the subClass attribute via its generic subClass rejection but does not look for a <GDALWarpOptions> element. Reject both.
• Resample algorithm beyond nearest: fire the rejection whenever SrcRect and DstRect sizes differ and the algorithm is not nearest, regardless of which source tag declared it.
• Complex mask / alpha source semantics that the GeoTIFF attrs contract cannot carry: <UseMaskBand> flags and per-source mask references. Reject.

Each rejection raises VRTUnsupportedError (already defined in _errors.py) and names the offending source path and field, so the caller can find the bad source without re-parsing the XML.

Acceptance:

• Both entry points route through the validator.
• Unit tests cover every new rejection path.
• Existing supported VRT tests still pass.