feat: Extended validation of config files

[kentquirk]

Which problem is this PR solving?

• Config file validation did not include any values specified on the command line or in the environment.

Short description of the changes

• After initial validation of the raw config, we unmarshal it into a config structure, write it back out to a local YAML buffer, and then revalidate the now-hydrated config. This also required masking the keys in the error output, injecting fake keys if they weren't specified at all, and fixing a test.

Fixes #775.