Warn if the workflow itself is invalid

[woodruffw]

Per zizmorcore/zizmor#51 -- sometimes people put settings directly on the step: body without a with: clause, which both doesn't affect GHA and also causes a confusing message from zizmor (since it complains about the same audit finding, but the "fix" is also visible in the render).

To improve this, we could warn if a Step body has keys other than the ones we expect. This probably needs to be done in github-actions-models and then propagated as an error here.

[woodruffw]

Nothing for myself: we could achieve this by adding #[serde(deny_unknown_fields)] to most of the github-actions-models models.

[woodruffw]

I experimented a bit more with this, and it's unfortunately going to be nontrivial: we use flatten in a lot of different places, which doesn't interact correctly with deny_unknown_fields. To do this I'll probably need to tear out flatten everywhere and replace it with manually-flattened fields.