Don't return 400 when read-only property is provided (#1655)

Fixes #942 

No longer return 400 if a read-only property is provided, as discussed
in the issue. We still raise an error if write-only properties are
included in the response and response validation is enabled.

I also changed how read-/write-only works in combination with
`required`. Previously, `required` would not be overwritten by
read-/write-only. Now we just follow the spec to the letter:
- required and read-only: must be included but must be ignored by the
server
- required and write-only: impossible to achieve, but I also don't see
how this combination could make sense
- read-only: may be included but must be ignored by server
- write-only: must not be included by server

tests/test_json_validation.py

@@ -60,8 +60,6 @@ def test_readonly(json_validation_spec_dir, spec, app_class):
     )
     app_client = app.test_client()
 
-    headers = {"content-type": "application/json"}
-
     res = app_client.get("/v1.0/user")
     assert res.status_code == 200
     assert res.json().get("user_id") == 7
@@ -77,7 +75,7 @@ def test_readonly(json_validation_spec_dir, spec, app_class):
         "/v1.0/user",
         json={"user_id": 9, "name": "max"},
     )
-    assert res.status_code == 400
+    assert res.status_code == 200
 
 
 def test_writeonly(json_validation_spec_dir, spec, app_class):