Strict mode: error/warning on unknown config keys

[Niccolum]

Motivation:
Typos in config file keys and stale keys left after schema refactors are silently
ignored today. Hoplite's strict() mode raises an error ("Config value 'x' was
unused") with exact file location for any key in a source that does not map to a
field in the schema.

Proposal:
load(..., strict: Literal["off", "warn", "error"] = "off"):
After merging sources, compare the keys present in merged data against the schema
(resolved with all naming-convention variants and aliases from expansion/ alias_provider.py). Report unmatched keys using the existing FieldOrigin /
SourceEntry structures from report_types.py for source location.

Acceptance criteria:

• Unknown key at any nesting depth → warning (logging.warning) or
  ConfigError depending on strict level.
• Known aliases and naming-convention variants (snake_case, camelCase, …) are NOT
  reported as unknown.
• skip_broken_sources=True still respected; strict check runs after successful load.
• Tests for nested unknown keys, aliased fields, and warn vs error levels.
• changes/ fragment.

References: hoplite ConfigLoaderBuilder.strict(), "Config value '…' was unused".