feat(13-01): add the prohibited rule and dated-download and notification masks

- lagoon.ValidateRequest supports Laravel 9 prohibited (!required, not
  implicit); with no catalog line its message is validation.prohibited
- tide compares Content-Disposition with real calendar dates masked on both
  sides; a different name, an invalid date or a one-sided date still diffs
- tide.NormalizePublications masks a Carbon +00:00 $.data.payload.created_at
  and an uncaptured positive integer $.data.payload.id as {{id}}
- the album-date test's outside-album sibling moves off payload.created_at,
  which now has its own mask
- READMEs and docs describe the rule and both masks

modules/lagoon/validate_rules.go

@@ -34,7 +34,7 @@ var imageExtensions = []string{"jpg", "jpeg", "png", "gif", "bmp", "svg", "webp"
 // parameter count: -1 any number (at least one), 0 none.
 var requestRuleArity = map[string]int{
 	"required": 0, "present": 0, "filled": 0, "accepted": 0,
-	"nullable": 0, "sometimes": 0, "bail": 0,
+	"nullable": 0, "sometimes": 0, "bail": 0, "prohibited": 0,
 	"array": -2, "string": 0, "integer": 0, "numeric": 0, "boolean": 0,
 	"email": 0, "url": 0, "date": 0,
 	"after": 1, "after_or_equal": 1, "before": 1, "before_or_equal": 1,
@@ -278,6 +278,10 @@ func (v *requestValidator) passes(rule Rule, attr string, value any, present boo
 		return !present || validateRequired(value), nil
 	case "accepted":
 		return validateRequired(value) && isAccepted(value), nil
+	case "prohibited":
+		// Laravel 9 validateProhibited: !validateRequired. Not implicit, so it
+		// never runs for an absent key or a blank string.
+		return !validateRequired(value), nil
 	case "nullable", "sometimes", "bail":
 		return true, nil
 	case "array":