feat(10.1-01): render header and form partials into an allowlisted node tree

- fields.yaml type: partial with a bare path name and config_list.yaml
  headerPartial resolve to {ConfigDir}/_{name}.htm, parsed at boot; the
  controller must implement pact.AdminPartialData
- html/template render against a curated view model, then x/net/html
  ParseFragment and a tag, attribute and URL allowlist with 64 KiB, 2000-node
  and depth-32 caps; the model type and trusted template types are refused
- GET .../partials/{name} with optional ?id= loaded through the form scope
- golang.org/x/net becomes a direct requirement (D-18), no new module

modules/cabana/security_coverage_test.go

@@ -45,6 +45,7 @@ var phase09Routes = []adminRoute{
 	{key: "GET /{vendor}/{plugin}/{controller}/schema/list"},
 	{key: "GET /{vendor}/{plugin}/{controller}/schema/form"},
 	{key: "GET /{vendor}/{plugin}/{controller}/schema/relation/{name}"},
+	{key: "GET /{vendor}/{plugin}/{controller}/partials/{name}"},
 	{key: "GET /{vendor}/{plugin}/{controller}/fields/{field}/options", mounted: nestedGetRoute},
 	{key: "GET /{vendor}/{plugin}/{controller}/filters/{scope}/options", mounted: nestedGetRoute},
 	{key: "GET /{vendor}/{plugin}/{controller}"},
@@ -269,6 +270,7 @@ func phase09ProtectedCalls() []phase09Call {
 		{"bulk-delete", (*service).bulkDelete},
 		{"widget-action", (*service).widgetAction},
 		{"toolbar-action", (*service).toolbarAction},
+		{"partial", (*service).partial},
 		{"show", (*service).show},
 		{"update", (*service).update},
 		{"delete", (*service).deleteRecord},