Validate operator input counts

[robertknight]

Model conversion doesn't currently check the number of inputs to each operator. This can lead to errors at runtime if it is different than what is expected. eg. In #132, the Reduce* ops expected a single input but were being passed two, as an attribute had been promoted to an input, which has been a fairly common occurrence in the evolution of the ONNX spec.