Fail validation for extra data

Suppose your openapi.yaml defines two string fields, title & `description. Both are required.

• Scenario A:

You send the following data to the API:

{
    'title': 'foo',
    'descriptioin': 'bar'
}

And the API will tell you that description field is required and you notice the descriptioin typo in your request.

• Scenario B:

You change the openapi.yaml so that descriptioon is no longer a required field.

You send the following data to the API:

{
    'title': 'foo',
    'descriptioin': 'bar'
}

And the API will silently ignore descriptioin field, and since description is no longer required, will return a 200 OK. You move on and then notice after two weeks that you haven't saved any data 😱 😱 😱

Start with the request-validation behavior driven by the repository's openapi.yaml schema and reproduce both request scenarios from the issue. Trace how unknown fields are handled, then verify that a misspelled optional field is not silently accepted and that the API reports the invalid input instead of returning success.