Validate secrets/config against the schema before setting the value

[alecthomas]

Now that we (mostly) have secrets/config going through the controller, we should add validation when setting them. For the controller version the schema can be loaded from the DB, but for the purely local case we'd need to load the schema from the build directory. I can't recall if we have any generic "validate this data against this schema" mechanism, so we might need to implement that first if not.

This might be contingent on #1775