feat(19.6.1-02): per-record locked permission values

- cabana.PermissionRecordLock and the optional PermissionRecordLockProvider
- RecordMeta.PermissionLocks (meta.permissionLocks) on show and save responses, notes localized
- save rule: a record-locked code keeps its stored value, a differing present value is 403
- Roles lock code-declared grants (locked_by_code); Administrators lock every override on your own record (locked_self)
- SPA: FORM_PERMISSION_LOCKS, locked codes never sent, record-locked rows in the permission editor
- regenerated admin OpenAPI and schema.d.ts; docs and README

modules/phrasebook/backend/lang/en/lang.yaml

@@ -261,6 +261,8 @@ permissioneditor:
   inherit: Inherit
   deny: Deny
   locked: You cannot change this permission.
+  locked_by_code: Granted to this role by a plugin. It cannot be removed here.
+  locked_self: You cannot change your own permissions.
   empty: No permissions are defined yet.
   other: Other
 api_tokens:

modules/phrasebook/backend/lang/pl/lang.yaml

@@ -283,6 +283,8 @@ permissioneditor:
   inherit: Dziedzicz
   deny: Odmów
   locked: Nie możesz zmienić tego uprawnienia.
+  locked_by_code: Nadane tej roli przez wtyczkę. Nie można go tu odebrać.
+  locked_self: Nie możesz zmieniać własnych uprawnień.
   empty: Nie zdefiniowano jeszcze żadnych uprawnień.
   other: Inne
 api_tokens: