profile validate --strict rejects forceInternetSharingOff (com.apple.MCX), but contour's own mscp data prescribes it

## Summary

`contour profile validate --strict` rejects `forceInternetSharingOff` under `com.apple.MCX` as an unknown key, but this is exactly the key contour's *own* bundled mSCP data prescribes for the `system_settings_internet_sharing_disable` rule (CIS Level 1/2, DISA STIG, NLM AP Gov+, and the "recommended" baseline all include it):

```
$ contour mscp schema rule system_settings_internet_sharing_disable --json
...
"mobileconfig_info": "[{\"keys\":{\"forceInternetSharingOff\":true},\"payload_type\":\"com.apple.MCX\"}]",
...
"baselines": ["cis_lvl1", "cis_lvl2", "disa_stig", "nlmapgov_plus", "recommended"]
```

But validating a profile that sets exactly that key/payload fails:

```
$ contour profile validate ./disable-internet-sharing.mobileconfig --strict
✗ ./disable-internet-sharing.mobileconfig: Unknown key 'forceInternetSharingOff' (strict mode)
```

## Impact

There's no way to author a `.mobileconfig` for this mSCP-endorsed CIS/STIG control that passes `--strict`, even though `contour mscp` itself generates/endorses the exact same key. This is a real gap: `com.apple.MCX` predates Apple's currently-published `apple/device-management` schema (I couldn't find `forceInternetSharingOff` documented there either), but it's still a functioning, actively-recommended key via mSCP.

## Ask

Could `profile validate`'s embedded schema recognize the keys that `contour mscp` itself emits for `com.apple.MCX` (and any other legacy/undocumented-by-Apple payload types mSCP relies on), so the two tools agree? Short of that, a documented way to allowlist a specific key (e.g. via `.contour/config.toml`) would unblock CI gates built around `--strict` for repos that ship mSCP-sourced profiles.

## Version

`contour 0.4.0-beta.4+20260624.1010`

Start by reproducing the failure with `contour profile validate --strict` and compare it with `contour mscp schema rule system_settings_internet_sharing_disable --json`. Trace how the embedded schema handles `com.apple.MCX` and how mSCP emits `forceInternetSharingOff`; done means an mSCP-prescribed profile passes strict validation, or the requested allowlist behavior is clearly defined and documented.

Written by the indexing model from the issue text.