feat!: close inline objects by default

[maxholman]

Breaking change: this ships as 7.0.0. Stricter validation makes some requests and responses fail that pass today.

Stacked on the modernisation PR (chore/modernise). Until that merges, this PR's diff also shows its commits. Only the last commit, feat!: close inline objects that list their properties, belongs to this PR.

Why

In OAS 3.1, Schema Objects are JSON Schema 2020-12. There, leaving out additionalProperties "has the same assertion behavior as an empty schema", so any extra key passes. A request body declared as a oneOf of inline objects therefore accepts keys the API never documented, and a handler that forwards the validated body passes them on. Schema.synth() already closed a named schema's top-level object, but no deeper. This makes the construct block mass assignment (overposting) at every level by default.

What changes

Schema.synth() adds additionalProperties: false to every inline object schema that declares properties and sets none of additionalProperties, patternProperties or unevaluatedProperties. The walk recurses under:

• properties
• items
• prefixItems
• oneOf and anyOf
• additionalProperties, when it is a schema

These are left as written:

• Maps (additionalProperties: { type: string }) and free-form { type: object } with no properties.
• allOf members. The walk does not enter them, because closed members reject each other's keys and break composition.
• $ref objects. A referenced component is closed, or not, by its own Schema.
• Explicit values. An explicit additionalProperties, patternProperties or unevaluatedProperties always wins.

The schema passed in is not modified. Closing works on copies, so reusing schema1.schema inside another schema's allOf still sees the original.

For review

1. Inconsistency at the root, kept on purpose. The existing top-level default closes any type: "object", even one with no properties. Nested free-form objects stay open, so a free-form object is open inline and closed as a named schema. The root now also closes when it declares properties without type: "object", for example type: ["object", "null"], which the old check missed.
2. The response side. The same schemas describe responses. There, a client that validates with the spec rejects a field the server adds later. The top-level default already did this for named schemas. The recursion extends it to every inline object nested inside a schema: object properties, array items, tuple members and oneOf/anyOf branches, including map values. Nested objects reached by $ref are unaffected, since their own top-level default already closed them. After this change, adding a field to any inline response object is breaking for strict clients. To keep a response object open, set additionalProperties: true on it, or model it as a $ref whose root sets additionalProperties: true.

Tests

__tests__/close-objects.test.ts covers:

• each recursion site
• several levels of nesting
• the map, free-form and allOf cases
• explicit additionalProperties / patternProperties / unevaluatedProperties
• a $ref passthrough
• the root default on a free-form object
• that the input is not modified

The existing fixture snapshots don't change, because their nested objects are already closed or referenced.

just check passes: typecheck, lint (0 diagnostics), fmt-check, tests and fallow.