Validates a host's ceiling and applies its defaults. An empty domains or
roots list removes its capability (an empty list grants nothing); the
capability's other settings are validated all the same. A configuration
read from JSON gets no type check, so each value's kind is checked here:
a mistyped audit setting, a list of the wrong shape or a bound out of its
range fails here, naming its key, never later at a call.
Validates a host's ceiling and applies its defaults. An empty
domainsorrootslist removes its capability (an empty list grants nothing); the capability's other settings are validated all the same. A configuration read from JSON gets no type check, so each value's kind is checked here: a mistyped audit setting, a list of the wrong shape or a bound out of its range fails here, naming its key, never later at a call.