kapp does not validate resources before sending to k8s api (e.g. extra unknown keys)

# Problem
When deploying with kapp, additional json keys that are not part of a K8s object's spec are automatically removed without errors or warnings.
This is a problem because erroneously specified k8s objects are not detected.
Example:
```yaml
apiVersion: v1
kind: ConfigMap
annotations: # should be inside 'metadata'-block
wrong: "ignored"
metadata:
name: "test-config"
data:
key: "value"
```

This is an actual problem that is continuously occurring with cf-for-k8s, e.g.
https://github.com/cloudfoundry/cf-for-k8s/issues/102
and
https://github.com/cloudfoundry/metric-proxy/pull/2.

# Expected behaviour

Kapp should not silently remove keys from an object's spec. Kapp should return an error from the k8s API server instead.

Start by reproducing the issue's ConfigMap YAML example and tracing kapp's resource submission path to the Kubernetes API. Done means an unknown top-level key is rejected with an error instead of being silently removed, with coverage for the reported behavior.

Written by the indexing model from the issue text.