config/schema: support validate annotation

It allows to add a specific validator for a particular schema node.

Part of #8725

NO_DOC=the module is for internal use from the config code
NO_CHANGELOG=see NO_DOC