SAM transform silently drops unrecognized CodeUri/ContentUri sub-properties despite schema declaring additionalProperties: false

### Description

Unrecognized sub-properties of `CodeUri` (on `AWS::Serverless::Function`) and `ContentUri` (on `AWS::Serverless::LayerVersion`) are discarded during the SAM transform without any error or warning. `sam validate`, `sam validate --lint`, and the transform itself all report success, and the generated `AWS::Lambda::Function` `Code` property simply omits the property.

This is a validation gap rather than a missing feature: `definitions.CodeUri` in the SAM schema already declares `"additionalProperties": false`, so the schema does describe these as invalid. Nothing enforces it at transform time.

The practical consequence is that a typo or a wrong-but-plausible property name is indistinguishable from a correctly applied setting. There is no signal anywhere in the workflow.

A concrete case where this is easy to hit: the CloudFormation property is named `S3ObjectStorageMode`, while the SAM property added in #3959 is named `StorageMode`. Reaching for the CloudFormation name inside `CodeUri` is a natural mistake, and it fails silently.

### Steps to reproduce

`template.yaml` — note `S3ObjectStorageMode`, which is not a valid `CodeUri` sub-property:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
Fn:
Type: AWS::Serverless::Function
Properties:
CodeUri:
Bucket: somebucket
Key: somekey
Version: '1'
S3ObjectStorageMode: REFERENCE
Handler: hello.handler
Runtime: python3.12
```

```console
$ sam validate --template template.yaml
/tmp/samtest/template.yaml is a valid SAM Template. This is according to basic SAM Validation, for additional validation, please run with "--lint" option

$ sam validate --lint --template template.yaml
/tmp/samtest/template.yaml is a valid SAM Template
```

Running the transform directly to inspect the output, rather than inferring it from a deployment:

```python
from samtranslator.parser.parser import Parser
from samtranslator.translator.translator import Translator

template = {
"AWSTemplateFormatVersion": "2010-09-09",
"Transform": "AWS::Serverless-2016-10-31",
"Resources": {
"Fn": {
"Type": "AWS::Serverless::Function",
"Properties": {
"CodeUri": {
"Bucket": "somebucket",
"Key": "somekey",
"Version": "1",
"S3ObjectStorageMode": "REFERENCE",
},
"Handler": "hello.handler",
"Runtime": "python3.12",
},
}
},
}

out = Translator(managed_policy_map={}, sam_parser=Parser()).translate(
sam_template=template, parameter_values={}
)
print(out["Resources"]["Fn"]["Properties"]["Code"])
```

### Observed result

The transform completes successfully with no error and no warning. The unrecognized property is absent from the output:

```
{'S3Bucket': 'somebucket', 'S3Key': 'somekey', 'S3ObjectVersion': '1'}
```

The same silent-drop behaviour occurs for any unrecognized key. Three variants tested against `aws-sam-translator` 1.111.0, all producing the identical `Code` above with no diagnostic:

| `CodeUri` contains | Transform result | Present in output |
|---|---|---|
| `S3ObjectStorageMode: REFERENCE` | succeeded, no warning | no |
| `StorageMode: REFERENCE` | succeeded, no warning | no |
| `TotallyMadeUpProperty: whatever` | succeeded, no warning | no |

The `StorageMode` row is expected on 1.111.0, since #3959 merged on 2026-07-20 and the most recent release (1.111.0) was published 2026-07-02. It is included to show that the drop is not specific to genuinely invalid names — before a property is released, the valid spelling behaves identically to a typo, with nothing to distinguish them.

### Expected result

An unrecognized sub-property of `CodeUri` or `ContentUri` should produce a validation error, consistent with `"additionalProperties": false` already present in the schema. Failing that, a warning naming the ignored property would at least make the behaviour discoverable.

Erroring on unknown properties is the more useful behaviour here, because these properties change deployment semantics. Silently ignoring `StorageMode` means a function intended to reference an object in place is instead created with a copy, and nothing surfaces the difference.

I appreciate this may be a deliberate compatibility decision, in which case documenting it, or surfacing it under `--lint`, would still close the discoverability gap.

### Additional environment details

1. OS: macOS (Apple silicon)
2. `sam --version`: SAM CLI, version 1.162.1
3. `aws-sam-translator`: 1.111.0 (current release on PyPI at the time of testing)
4. AWS region: not applicable, reproduced entirely at template transform time with no deployment

Start with definitions.CodeUri in the SAM schema and the Parser/Translator entry points shown in the report; run the supplied transform and sam validate reproductions to trace where unknown keys are discarded. Add coverage for unknown CodeUri and ContentUri sub-properties, then confirm that validation or warning behavior appears consistently in both commands and transform output.

Written by the indexing model from the issue text.