Enforce datatype and allowsOnly on incoming commits #2160

On commit the server only checks required properties, and only when validate_schema is set (lib/src/commit.rs:1096-1098, resources.rs:368-393). Datatype and allowsOnly checks run in Resource::set (resources.rs:1463-1510), which is where a resource is edited locally, not on incoming Loro updates; commit.rs and loro.rs have no datatype checks. validate.rs:1-2 says store validation "might be deprecated".

So a client can store a string in an Integer property, or a value outside allowsOnly. When classes are used as the contract for data that other systems rely on (case types, process definitions), the server must enforce them.

Requirements

1. The server rejects any commit, over HTTP or over sync, that leaves a resource violating its classes: wrong datatype, a value outside allowsOnly, a missing required property, or a reference to a resource of the wrong class.
2. The rejection names the property and the rule that failed.
3. Changing a class does not silently make existing resources invalid; there is a defined way to evolve a class and its instances.

Done when commits with a wrong datatype or a value outside allowsOnly are rejected over HTTP and over sync, with tests for both paths.

Part of #2154.