Securely Partitioning Spacecraft Computing Resources: Validation of a Separation Kernel