feat(cabana): plugin updates and marketplace search on the Plugins screen

- GET /plugins looks up each versioned plugin's releases through
  kiosk.Client and applies plugin:update's rule (NewestCompatible above
  the BaseVersion), with the update command and the framework a newer
  release needs
- GET /plugins/marketplace forwards q and category (validated like the
  registry), marks installed and incompatible plugins and returns the
  install command; ids outside the plugin ID shape are dropped
- 4 s per-call timeout, at most 4 lookups at once, in-process cache
  (searches 5 min, releases 15 min, failures 1 min); a failing registry
  gives status unavailable, an empty plugins.registry_url sends nothing
- SPA: update badges and Marketplace tab with copy buttons (clipboard
  fallback), hidden when the registry is disabled; no install button
- OpenAPI, SPA types, inventories, conformance case, en/pl strings, docs

modules/cabana/security_coverage_test.go

@@ -54,6 +54,7 @@ var phase09Routes = []adminRoute{
 	{key: "GET /field-types"},
 	{key: "GET /settings"},
 	{key: "GET /plugins"},
+	{key: "GET /plugins/marketplace"},
 	{key: "GET /settings/{code}/schema"},
 	{key: "GET /settings/{code}"},
 	{key: "PUT /settings/{code}"},
@@ -309,6 +310,7 @@ type phase09Call struct {
 func phase09ProtectedCalls() []phase09Call {
 	return []phase09Call{
 		{"plugins-installed", (*service).pluginsInstalled},
+		{"plugins-marketplace", (*service).pluginsMarketplace},
 		{"list", (*service).list},
 		{"create", (*service).create},
 		{"bulk-delete", (*service).bulkDelete},