config validate: detect bare/null unsupported sections (true key-presence)

Part of #22. Follow-up to review feedback on #31.

Problem

The current cfg.<Section> != nil check in pkg/cmd/config/validate/validate.go and pkg/cmd/config/configutil/configutil.go only rejects explicitly-empty unsupported sections (e.g. upstreams: []). It does not reject:

• upstreams: (bare key, no value) — unmarshals to nil
• upstreams: null — unmarshals to nil

Same for consumer_groups and service_templates. A user who declares any of these forms gets silent acceptance.

Fix

Two-pass parse: first into map[string]yaml.Node (or map[string]json.RawMessage for JSON), check whether the key is present at all, then decode into the typed api.ConfigFile. If a key for an unsupported section is present, reject regardless of value.

Tests

Extend TestConfigValidate_EmptyUnsupportedSections (or add a sibling table) with cases:

• upstreams: (no value)
• upstreams: null
• consumer_groups: / consumer_groups: null
• service_templates: / service_templates: null

All should produce the same "X are not supported" error as the existing [] cases.