Initially, I thought I needed to move these to lib because I was about to introduce a new endpoint that took ClientResponses as input.
I ended up removing ClientResponses from the input, so this diff isn't really necessary.
That said, I feel like it's probably "good practice" in our codebase to move all validators to lib, so I decided to put this diff up. If reviewers disagree, I'm open to abandoning it.
Note that this also required moving some validators for reports.
Depends on D12360