Add validation for Container.Env

This includes backwards compat with the older "key" field.

Builds on #330
You missed a "name" inside the json field. We really need a thingy that sets all fields, marshals and unmarshals to catch these.