Warn about unused keys

[Zaharid]

The semantics are trickier than it seems. We should detect whether the parent mapping is used as a namespace and if yes track every key inside. E.g. the root level is always a namespace but may contain a dict where we use the literal value.

However the identity comparison should be by input key rather than by nsspec.

This probably requires a much needed rewrite of the resolve_key machinery.