Reject invalid configuration keys

[SoundGoof]

Summary

Reject invalid or misspelled configuration keys instead of silently ignoring
them.

In bolkedebruin#153, unsupported values such as the top-level authentication key and
Server.Tls: off were ignored. This resulted in a misleading
Not enough hosts to connect to specified error instead of identifying the
invalid configuration.

Changes

• Decode the complete configuration in strict mode.
• Report unknown top-level and nested keys.
• Validate Server.Tls against auto, enable, and disable.
• Report decoding and validation errors together.
• Preserve case-insensitive YAML keys and inline comments.
• Remove obsolete defaults that do not correspond to configuration fields.

Testing

• Added tests for unknown top-level and nested keys.
• Added coverage for invalid TLS modes and combined errors.
• Verified valid lowercase YAML with comments still loads.
• go test -mod=mod ./...
• go vet -mod=mod ./...

Fixes bolkedebruin#153