container_spec: avoid a traceback on invalid yaml content
    
    Raise a ValidationError rather than a YAMLError when yaml parsing fails.
    There would be some argument to catch YAMLError in the CLI, but it's
    hard to imagine a caller of the API handling YAMLError and
    ValidationError differently.