Add validation for Container.Env

This includes backwards compat with the older "key" field.

Builds on #330
gofmt? Also, it's the "name" in the yaml: and json: sections that determines how it gets marshaled, so this isn't doing what you want it to.