feat(12.2-02): add the fileupload field with deferred uploads committed on save

- type: fileupload compiles the D-08 keys and binds to the model's attach.Relation at boot
- X-Session-Key (cabana.SessionKeyHeader) carries the form session key; RecordInput.SessionKey
- GET and POST .../{id}/files/{field}: list with pending uploads, multipart upload into attach.Store
- the create and update save attaches the session's pending files in its transaction
- swagger2openapi folds formData parameters into a multipart requestBody
- admin OpenAPI, TS types, conformance cases, README and forms docs

modules/cabana/security_coverage_test.go

@@ -62,6 +62,8 @@ var phase09Routes = []adminRoute{
 	{key: "GET /{vendor}/{plugin}/{controller}/{id}/relations/{name}/candidates"},
 	{key: "POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/link"},
 	{key: "POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/unlink"},
+	{key: "GET /{vendor}/{plugin}/{controller}/{id}/files/{field}", mounted: nestedGetRoute},
+	{key: "POST /{vendor}/{plugin}/{controller}/{id}/files/{field}"},
 	{key: "GET /assets/{vendor}/{plugin}/{file...}", public: true, spa: true},
 	{key: "GET ", public: true, spa: true},
 	{key: "GET /{path...}", public: true, spa: true},
@@ -286,6 +288,8 @@ func phase09ProtectedCalls() []phase09Call {
 		{"relation-candidates", (*service).relationCandidates},
 		{"relation-link", (*service).relationLink},
 		{"relation-unlink", (*service).relationUnlink},
+		{"file-list", (*service).fileList},
+		{"file-upload", (*service).fileUpload},
 		{"settings-schema", (*service).settingsSchema},
 		{"settings-get", (*service).settingsGet},
 		{"settings-put", (*service).settingsPut},