Ensure packages can't lie to the scheduler

[adelhult]

Packages declare the variables they want to have access to as well as the variables that the elements they spawn should have access to. This allows the scheduler to come up with a valid order to evaluate the document. The problem is that this is in now way enforced, packages can if they want produce new elements that need accesses that were not included in the manifest.