feat(12.1-01): cabana.ForbiddenError answers a refused write with 403

- hooks and bulk, record, toolbar and widget actions may return it
- 403 forbidden with the localized message and field details; the write's
  transaction is rolled back; other errors stay the opaque 500
- form shows a refused save as a persistent banner and keeps the values;
  a refused delete is a toast
- smoke tests, OpenAPI notes, dist, README, docs

modules/cabana/testdata/roster/lang/en/lang.yaml

@@ -12,3 +12,6 @@ people:
   reinstate: Reinstate
   reinstate_confirm: Lift the ban on this person?
   state_inactive: Not active
+  refused: You may not rename this person.
+  refused_name: This name is reserved.
+  locked: This person is locked and cannot be changed.