test(13-06): cover the Phase 13 framework edges in surf, conga, lagoon and tide

- surf: a transitive three-route family, HEAD and sorted Allow on family
  paths, a family across two plugins with per-member middleware, refused
  trailing-slash and multi-segment shapes
- conga: refusal messages name kind and queue, a configured queue counts
  as served, a delayed unregistered dispatch waits scheduled
- lagoon: prohibited under a wildcard, on a dotted path and after bail
- tide: quoted, RFC 5987 and multi-date download names; a captured id
  beside a masked notification id

modules/lagoon/validate_request_test.go

@@ -713,3 +713,43 @@ func TestValidateRequestProhibited(t *testing.T) {
 		t.Errorf("mixed = %#v, want %#v", got, want)
 	}
 }
+
+// TestValidateRequestProhibitedNested: prohibited under a wildcard names
+// each offending element, passes on elements that leave the key empty, and
+// works on a dotted path into a nested object; a bail before it stops at
+// the first failure as for any rule.
+func TestValidateRequestProhibitedNested(t *testing.T) {
+	rules := []RequestRule{{Field: "albums.*.shelf", Rules: ParseRules("prohibited")}}
+	input := map[string]any{"albums": []any{
+		map[string]any{"name": "a", "shelf": "A1"},
+		map[string]any{"name": "b"},
+		map[string]any{"name": "c", "shelf": ""},
+		map[string]any{"name": "d", "shelf": []any{"x"}},
+	}}
+	got := mustValidate(t, inLocale("en"), input, rules)
+	want := map[string][]string{
+		"albums.0.shelf": {"validation.prohibited"},
+		"albums.3.shelf": {"validation.prohibited"},
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("wildcard = %#v, want %#v", got, want)
+	}
+	if got := mustValidate(t, inLocale("en"), map[string]any{"albums": []any{}}, rules); len(got) != 0 {
+		t.Errorf("empty list = %#v, want none", got)
+	}
+
+	dotted := []RequestRule{{Field: "meta.condition", Rules: ParseRules("prohibited")}}
+	if got := mustValidate(t, inLocale("pl"), map[string]any{"meta": map[string]any{"condition": nil}}, dotted); len(got) != 0 {
+		t.Errorf("dotted null = %#v, want none", got)
+	}
+	got = mustValidate(t, inLocale("pl"), map[string]any{"meta": map[string]any{"condition": "VG+"}}, dotted)
+	if want := map[string][]string{"meta.condition": {"validation.prohibited"}}; !reflect.DeepEqual(got, want) {
+		t.Errorf("dotted = %#v, want %#v", got, want)
+	}
+
+	bailed := []RequestRule{{Field: "shelf", Rules: ParseRules("bail|prohibited|string|max:2")}}
+	got = mustValidate(t, inLocale("en"), map[string]any{"shelf": "ABC"}, bailed)
+	if want := map[string][]string{"shelf": {"validation.prohibited"}}; !reflect.DeepEqual(got, want) {
+		t.Errorf("bail = %#v, want %#v", got, want)
+	}
+}