move rejection of unknown/unwanted keys to Build::Config#normalize