Warn about unknown keys in service.template

Previously, if you accidentally use the wrong key in service.template (e.g. web: python3.9 instead of type: python3.9, seen in T379452), webservice would just silently ignore it, which was confusing.

Note that this means the command line that goes into argparser is now assembled differently. Previously, the arguments were always added in the same order (--backend, then --cpu, then --mem, etc.), and the template file only controlled their values and whether they appeared at all or not. Now, they are added in the order in which they appear in the template file, with the type (which is a positional argument, not an option) potentially in between the other options. I think this should still work, but it’s certainly worth testing before this is deployed.

Also raise an error if the template file isn’t even a dict. Previously, I think this would’ve caused a TypeError in some cases (e.g. argument of type 'int' is not iterable; or string indices must be integers, not 'str'), and no error (but no changes to the options) in other cases.