Restrict the json schema of medias better

[hmpf]

Turns out, json schema is a bit too forgiving. If you send in json with an unknown key, that json will still be valid. To prevent that, '"additionalProperties": false' needs to be a sibling of "properties".

[hmpf]

We need this to better protect what is in "settings", and to be able to report/log an error when somebody sends in settings with an extra object (imagine a multiple-terabyte large file as a hexdump, say.)