Only allow defined formats.

We've been accidentally using invalid formats like "timestamp" in some places, so this helps ensure we use formats that will actually have a validation effect.