feat(xsd): add strict XSD validation with comprehensive schema resolution

[AlexanderWillner]

Summary

Adds validate_xsd_strict — a strict-mode XSD validation API that reports all unknown elements/attributes as errors (unlike the existing lax validate_xsd which silently ignores them).

Motivation

The existing lax validator silently accepts unknown elements and attributes, making it unsuitable for catching real schema violations in production data. Strict mode is needed for validating NAS (AAA) XML files against the full AdV schema set (~200 schemas, ~1800 types).

Changes

New public API

• validate_xsd_strict(schema, xml) -> ValidationResult in validation::xsd

Strict validation functions

• validate_element_strict — type-resolves elements, reports unresolvable types
• validate_attributes_strict — reports unknown/undeclared attributes
• validate_complex_element_strict — validates content models with error reporting
• validate_sequence_strict — returns consumed count, supports report_unexpected flag
• validate_group_content_strict — validates named model group content
• validate_any_wildcard_strict — validates xsd:any with processContents=strict/lax

Schema resolution improvements (benefit both lax and strict)

• Named model group inlining: Two-pass parsing resolves <group ref="..."> by inlining referenced content as XsdParticle::Group
• Substitution group member resolution: Members validated against their own type declaration (not the abstract head's empty type)
• Compositor minOccurs propagation: Sequence/choice-level minOccurs=0 propagated to child particles
• attributeGroup ref resolution: Iterative transitive expansion with __attr_group__ sentinel
• Attribute ref declarations: Handles ref="prefix:localName" (e.g. xlink:href)
• Base attribute merging: Extension base types' attributes merged into derived types
• Cross-include prefix merging: xmlns declarations from included schemas merged into root prefix_map
• Imported prefix_map: ImportedSchema stores its own prefix_map for QName resolution
• SimpleContent attribute inheritance: Walks extension chains (e.g. gml:AreaType → gml:MeasureType → uom)
• Imported schema fallback: Unprefixed refs and unknown-prefix types scan imported schemas
• Choice Group alternatives: Choice validation handles XsdParticle::Group alternatives
• Group repetition: Unbounded groups loop while children are consumed

Test results

• 1075 existing tests pass (no regressions)
• Validated against 48 real-world NAS test files across 13 German federal states:
  • 30 pass with 0 errors
  • 10 fail with genuine source data defects (old NAS versions, GID6 files)
  • 4 fail with 0-6 errors in synthetic test constructs
• WFS Transaction files went from 91,000+ false-positive errors → 0 errors

[jonwiggins]

Thank you for this — I ran a deep review (merged onto current main, full test suite, clippy/fmt, plus hands-on probing of the new validation paths). The direction is exactly right: substitution groups, complexContent extension merging, named model group inlining, and a strict mode fill real gaps, and validating against a ~200-schema real-world NAS corpus (91k false positives → 0) is strong evidence the resolution work is sound. I want to merge this, but there are blocking issues first. I've closed #23/#24/#25 in favor of consolidating here (this branch contains all their commits; #25's xlink:href skip was intentionally dropped here, which I agree with).

Blocking

1. CI gates fail on the merged tree

• tests/seq_order.rs:10 reads /Users/aw/Repositories-CISS/... and unwrap()s — the test suite fails on any machine but yours. The two NAS tests inside xsd.rs at least skip when the path is absent, but they're permanent no-ops in CI and carry ~200 lines of eprintln! debug output. These need committed minimal fixtures (or an env-var gate).
• cargo fmt --check: 13 diffs across src/tree/element.rs, src/validation/xsd.rs, tests/seq_order.rs.
• cargo clippy --all-targets --all-features -- -D warnings: 36 errors in lib tests (new test fns sit outside the #[allow(clippy::unwrap_used)] mod tests block), plus 4 in the library proper (element.rs:67-68, too_many_lines and needless_range_loop in xsd.rs).
• cargo doc gains a rustdoc warning: validate_xsd's doc example was split by the insertion of a new function mid-doc-comment (xsd.rs:2054), and parse_element_decl's doc is truncated mid-sentence. Also parse_min_occurs's doc says "Returns 0 when not specified" but the code returns 1.

2. Denial of service: cyclic attributeGroup ref hangs parse_xsd
A self-referential group — <xs:attributeGroup name="A"><xs:attribute name="x"/><xs:attributeGroup ref="A"/></xs:attributeGroup> — sends resolve_attribute_groups' fixpoint loop into an infinite loop with unbounded memory growth (I killed it at 12.6 GB RSS after ~30 s). Schemas are untrusted input, and this is the same bug class as CVE-2026-61727, which we just patched in the DTD parser. Needs cycle detection (the merge_extension_bases code in this same PR does this correctly with a visited set — same pattern applies).

3. validate_xsd_strict misses missing required trailing elements
Schema sequence [a, b], both required; instance <root><a/></root>: strict returns valid, while the existing lax validator correctly reports the missing <b>. validate_sequence_strict exits its loop when children run out and never checks min_occurs of the remaining particles — so the strict API is less strict than lax on the most basic violation.

4. Namespace-correctness regressions that affect the existing lax path too

• element_matches_decl accepts a local element declaration when the child is in any imported namespace (verified: child in urn:other accepted where urn:main + elementFormDefault="qualified" requires urn:main).
• The substitution-group index is keyed by local name only, so members from unrelated namespaces are accepted for a head they don't belong to.
• resolve_type_name's "last resort" scans imported namespaces by local name in HashMap iteration order — nondeterministic when two namespaces share a type name.

5. The "__attr_group__" sentinel leaks behaviorally
An unresolvable attributeGroup ref leaves the placeholder in the attribute list, which then acts as a declared attribute: <root nosuchgroup="hello"/> passes strict validation with zero errors. A magic string in type_ref (6 occurrences, not even a named const) should be an enum variant — e.g. an XsdAttrEntry::GroupRef(String) — so unresolved refs are visible and can be reported.

6. Parallel strict validator duplication
~500 lines across 7 near-duplicate function pairs, and drift is already observable: strict mode falls back to the lax validate_choice/validate_all inside choice/all content (strict attribute checks silently vanish there), and validate_group_content_strict returns children.len() for Choice/All — greedily consuming all remaining siblings so later sequence particles never match. Threading a ValidationMode (or context struct) through one code path would eliminate the drift class entirely.

Non-blocking, but please consider

• Scope: the public Element/TagName/ElementAttribute wrapper (src/tree/element.rs, +169 lines) is unrelated to XSD validation and deserves its own PR and API discussion.
• API surface: ~20 previously-private fields on XsdSchema/XsdElement/ComplexType/ImportedSchema become pub, freezing the current local-name-keyed HashMap representation into the public API — exactly the representation that has to change to fix item 4. Read-only accessors would serve the stated need (element ordering for serialization) without the freeze.
• is_abstract is parsed but never enforced (abstract heads validate when used directly); ##other accepts children with no namespace (XSD 1.0 excludes absent); processContents="strict" is implemented as accept-without-validation; compositor maxOccurs="unbounded" propagation isn't handled. Fine as documented known gaps, but the headline features (strict mode, xsd:any, attributeGroup expansion, base-attribute merging) currently have essentially no direct unit tests — the substitution-group and extension-chain tests are good; the same rigor on the new paths would catch items 3 and 5 immediately.

With items 1–6 addressed this is a strong contribution and I'd be glad to land it. If it's useful, I'm happy to split the work: e.g. land the resolution improvements (groups/substitution/attributes) first, and iterate on strict mode separately.