Allow XML codec to operate in strict metadata mode

The transition to RFC7952 metadata handling has exposed the fact we will happily pass through any XML attribute. This does not quite align with the metadata model and hence needs to be rectified.

Since these attributes can only ever come from XML codec, expose enough knobs to restrict the accepted attributes and provide a policy for unrecognized attributes – either ignore them or fail parsing.