feat(10.1-01): render header and form partials into an allowlisted node tree

- fields.yaml type: partial with a bare path name and config_list.yaml
  headerPartial resolve to {ConfigDir}/_{name}.htm, parsed at boot; the
  controller must implement pact.AdminPartialData
- html/template render against a curated view model, then x/net/html
  ParseFragment and a tag, attribute and URL allowlist with 64 KiB, 2000-node
  and depth-32 caps; the model type and trusted template types are refused
- GET .../partials/{name} with optional ?id= loaded through the form scope
- golang.org/x/net becomes a direct requirement (D-18), no new module

modules/cabana/http.go

@@ -226,6 +226,8 @@ func (s *service) mount(r pact.Router) {
 		g.Post("/{vendor}/{plugin}/{controller}/toolbar/{action}", requireAjax(s.toolbarAction))
 		constrainController(g)
 		g.Where("action", "[A-Za-z_][A-Za-z0-9_]*")
+		g.Get("/{vendor}/{plugin}/{controller}/partials/{name}", s.partial)
+		constrainRelation(g)
 		g.Get("/{vendor}/{plugin}/{controller}/{id}", s.show)
 		constrainController(g)
 		g.Put("/{vendor}/{plugin}/{controller}/{id}", requireAjax(s.update))