More aggressive filtering of excluded keys

Our approvals have a lot of ID arrays, which can't be filtered out using `excluded_json_keys`. This means we end up having to update more approvals files than should be necessary, when we make a simple change to a spec.

This PR tweaks the filtering so we filter out whole arrays (in addition to simple values) if a key matches `excluded_json_keys`.

It may be too aggressive for general use, so not sure if we'll want to push this upstream. But it'll definitely save us time.

Note this PR also updates our fork with the latest upstream changes, which is why it's so big. The latest commit here is the real proposed change.