Add --strict to fail on unlisted or unclassified columns #1

[Description]:

datamask only touches columns marked pii=yes in the data dictionary. A column that is missing from the CSV, or present with a blank pii value, is left as it is without any warning, so a new column added after the dictionary was last updated ships unmasked.

An opt-in --strict flag would compare the CSV with the live schema (as datadict already reads it) and fail before masking if any column is missing from the CSV or has a blank pii value. Without the flag, behaviour stays as it is.

[Acceptance criteria]:

• datamask --strict ... exits non-zero and lists every missing or unclassified schema.table.column, without masking anything
• Columns explicitly marked no pass
• Without --strict, nothing changes
• Documented in the README