portabled: validate SYSEXT_LEVEL when attaching

When attaching a portable service with extensions, immediately validate
that the os-release and extension-release metadata values match, rather
than letting it fail when the units are started

(cherry picked from commit 239ac0c7)