Function validate_backend 

pub fn validate_backend(backend: &Backend) -> ValidationResult

Validate backend content the structural schema can’t express: the inline-NFS volume on a Filesystem backend, the secretRef XOR workloadIdentity rule on the cloud-IAM backends, Azure’s workload-identity prerequisites, and the S3 tls block’s consistency. Exhaustive match so a new Backend variant must be considered here before it compiles.