Per T357025 we can get the parsed contents of the request body from HandlerInterface::getParsedBody. This allows ParamValidator to validate body fields in the same way it validates form data. We just need to add support for the "body" source to ParamValidatorCallbacks::getParamsFromSource().
NOTE: This solution is insufficient to cover the need to fail on extraneous fields in the request body. One possible solution would be to provide a method that can explicitly be called from execute() that will perform the necessary check. This way, handlers that need this check can op into applying it in a straight-forward way.