Fix optional app and required app.user and app.group.

From the spec "app" is optional. I made it a pointer to avoid the validation of an empty field. This will affect applications using this package but this is usually the way go json handle empty json and I didn't find a better way.

Also user and group are defined as required so I added a validation.
Yes, that seems reasonable to me. I think we did not use `omitempty` as we were still figuring out which fields would be optional/mandatory.