feat(12.2-02): add the fileupload field with deferred uploads committed on save

- type: fileupload compiles the D-08 keys and binds to the model's attach.Relation at boot
- X-Session-Key (cabana.SessionKeyHeader) carries the form session key; RecordInput.SessionKey
- GET and POST .../{id}/files/{field}: list with pending uploads, multipart upload into attach.Store
- the create and update save attaches the session's pending files in its transaction
- swagger2openapi folds formData parameters into a multipart requestBody
- admin OpenAPI, TS types, conformance cases, README and forms docs

modules/cabana/phase10_csrf_test.go

@@ -67,9 +67,9 @@ func TestPhase10CSRF(t *testing.T) {
 		})
 	}
 	// refresh, logout, settings put, create, bulk-delete, widget action,
-	// toolbar action, update, delete, link, unlink
-	if unsafe != 11 {
-		t.Fatalf("walked %d state-changing routes, want 11: %v", unsafe, router.order)
+	// toolbar action, update, delete, link, unlink, file upload
+	if unsafe != 12 {
+		t.Fatalf("walked %d state-changing routes, want 12: %v", unsafe, router.order)
 	}
 
 	loginHandler := router.handlers[login]