strict/less-strict mode for validation

[karenetheridge]

Used to check for things that aren't errors, but things we would lint for if they were compiletime instead of runtime recommendations:

• (probably not..) - actual request or response headers that aren't covered by a definition in the spec document
• query parameters that aren't covered ""

These are errors, but perhaps should be relaxed, given some config variable:

• the operation (method/path combo) is not found in the specification. (presently an error, with 404 Not Found recommended)
• path is found, but not the method (presently an error, with 405 Method Not Allowed recommended)
• the request or response Content-Type isn't covered by a media-type definition in .../content/<media-type/... (presently an error, with 415 "Unsupported Media Type" recommended)
• the response code isn't covered by anything in the 'responses' specification (which means 'default' wasn't included) (presently an error)