Write a new set of config validation callbacks.

Unlike legacy_validate_fn_t, these callbacks have separation of
duties, into:

    * early normalization and computation.
    * validation
    * transition checking
    * late normalization and computation

Only the first and last steps get mutable objects.  Only the
transition-checking step gets to see the previous values of this
object.