fix(python): reject unknown keys on nested models, as ossie validate does

[ihadoop]

What

OssieDocument rejected an unknown key at the document root but silently dropped
one on any nested object, while validation/validate.py rejected the same
document. The SDK is the type layer the converters build on, so a mistyped key
could enter a pipeline as a clean model_validate() and simply disappear at
serialization.

Closes #530.

Why the boundary is exactly this

core-spec/ossie-schema.json sets additionalProperties: false on nine nodes —
CustomExtension, DialectExpression, Expression, Dimension, Field,
Dataset, Relationship, Metric, SemanticModel — and on no other node.
AIContext is the one open object, so OssieAIContextObject keeps
extra="allow"; the fix is nine extra="forbid", not a blanket one.

Reproduction, before

datasets:
  - name: orders
    fields:
      - name: amount
        descriptionn: "typo: should be 'description'"
metrics:
  - name: total_amount
    expresssion: {...}

SDK model_validate():        ACCEPTED, both keys dropped on serialization
validation/validate.py:      FAILED, 'descriptionn' was unexpected / 'expresssion' was unexpected

After: both report the same two locations, e.g.
loc=('datasets', 0, 'fields', 0, 'descriptionn') type=extra_forbidden.

One deliberate behavior change

OssieSemanticModel.model_validate() now rejects a document's version, which
it previously ignored. That matches the schema — the SemanticModel node has no
version property — and the SDK already documents OssieDocument, not
OssieSemanticModel, as the type for models embedded in an ontology map
(ontology.json embeds via $ref to the root schema, which requires version).

A test so it cannot come back

test_unknown_field_names_match_the_schema_allowlist reads ossie-schema.json,
derives the set of nodes that forbid extras, and asserts it equals the set of
models configured to forbid — plus that AIContext does not. A future schema node
that gains additionalProperties: false without a matching model config now fails
CI instead of silently re-enabling the drop.

The previous test_only_document_rejects_extra_fields asserted the buggy
behavior, so it is replaced by a parametrized test covering each nesting level.

Test plan

• python: 122 passed
• validation/tests: 181 passed (rebased onto feat(validation): validate several files per run and look up the schema via OSSIE_SCHEMA #545); validation/test_validate.py: OK; generate-spec-types.py --check: clean
• all four dependents of apache-ossie: dbt 176, hex 224, sigma 103, wisdom 37 passed
• converters/snowflake 186, converters/gooddata 94 (do not use the SDK; run as a regression check)
• dev/check-license (Apache RAT): passed
• CI Python matrix 3.11–3.13 — local run was 3.14

[github-actions]

Thank you for your first contribution to Apache Ossie (incubating)!

A committer will review your PR. In the meantime, please ensure:

• All CI checks pass
• ASF license headers are present on new source files
• Tests cover new functionality

No ICLA is required to contribute. If you are elected as a committer in the future, you will need an Individual Contributor License Agreement (ICLA) on file with the ASF.

Questions? Ask in the PR comments or join us on Slack.

We appreciate your contribution!

[jbonofre]

LGTM. The nine models that the schema marks additionalProperties: false now forbid extra fields, and AIContext stays open as in the schema. The version deletion in test_document_is_a_semantic_model is needed, since version would now be rejected on the embedded model.

One thing to note: documents with misspelled or unknown nested keys used to load and will now raise ValidationError. That is the intended behavior, but users may notice it.