Implement RejectUnknownQueryParameters (Fix #660)

[wolveix]

Hello again!

This PR implements an opt-in config option to reject unknown query parameters (fixes #660).

I'm not confident that this is the best way to achieve this, and I'm not particularly a fan of adding an additional function to the API interface definition; however, I couldn't find a better way to achieve this given that this check needs to happen in the Register function which doesn't have access to api.config.

[codecov]

Codecov Report

❌ Patch coverage is 94.44444% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.68%. Comparing base (3a43be6) to head (7259bf0).

Files with missing lines	Patch %	Lines
huma.go	93.10%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #925   +/-   ##
=======================================
  Coverage   92.67%   92.68%           
=======================================
  Files          23       23           
  Lines        4562     4594   +32     
=======================================
+ Hits         4228     4258   +30     
- Misses        275      276    +1     
- Partials       59       60    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[wolveix]

Looking back on this, I think there's a lot of similar requests around #910. So I wonder if we should instead have a shared ForceExplicitDefinitions (or a better name) that would enforce this logic for everything.

[danielgtaylor]

@wolveix is there a list of things that should be strict but aren't and can't easily be the new default? Query params are a good one. Operation IDs should be enforced to be unique. I'm trying to think of what else should be stricter.

[wolveix]

@danielgtaylor I thought there was another, though after a quick search I've not been able to find it. Since unique operation IDs will become the default (I'll rework my PR and merge it tomorrow), I guess it's just query params.

It'd be ideal if we could make it configurable from the config struct rather than the API struct. I couldn't see a way to do it when I opened this PR, though I'm much more intimately familiar with Huma's codebase now so I'd happily give it another look! That is, unless you have a better idea ;)