(cli): subcommands silently ignore non-existing flags / should hard fail when some feature flag is enabled (e.g. `--only-allowed-options`)

### Describe the bug

Running `cdk diff` with an unknown flag does not result in any kind of indication that there is a problem.

### Expected Behavior

`cdk diff [other options] --no-such-flag` should:

- Indicate clearly that the `--no-such-flag` is unknown. This way users immediately recognise where their mistakes are, rather than having to correlate each flag with the documentation to detect the error. Ideally, if there are multiple unknown flags, each one of them should be printed in a similar error message.
- Exit with a _unique non-zero exit code,_ rather than exit code 0/1. This way anyone automating CDK can tell the difference between different classes of errors.
- _Not_ run the diffing process, since the user very likely meant for the diffing process to do something which includes another flag.

### Current Behavior

`cdk diff --no-such-flag` runs the diff, prints no warnings related to the flag, and in fact does not indicate in any way that there is a problem.

### Reproduction Steps

Run `cdk diff --no-such-flag`.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.93.0 (build 724bd01)

### Framework Version

_No response_

### Node.js Version

v18.17.1

### OS

NixOS

### Language

Typescript

### Language Version

5.2.2

### Other information

_No response_