Warn if the workflow itself is invalid

[woodruffw]

Per #51 -- sometimes people put settings directly on the step: body without a with: clause, which both doesn't affect GHA and also causes a confusing message from zizmor (since it complains about the same audit finding, but the "fix" is also visible in the render).

To improve this, we could warn if a Step body has keys other than the ones we expect. This probably needs to be done in github-actions-models and then propagated as an error here.

[woodruffw]

Nothing for myself: we could achieve this by adding #[serde(deny_unknown_fields)] to most of the github-actions-models models.