test(10.1-04): cover the Phase 10.1 extension point Go code

- acme fixture plugin under modules/cabana/testdata/extension (gadgets
  controller, header and form partials, lookup widget, JS and CSS)
- TestPhase101FormExtensionSchema, TestPhase101PartialSchema and
  TestPhase101Toolbar: every widget, partial and toolbar boot rule
- TestPhase101PartialSanitizer: tag, attribute and URL allowlist, escaping,
  per-request trans, size/node/depth caps and the view-model guard
- TestPhase101Assets: exact-key asset hits, revalidation, SPA fall-through,
  boot path checks and ?v= schema URLs
- TestPhase101Actions (PostgreSQL): scoping, fill filter, strict body,
  action permission, error mapping, CSRF header, toolbar and partial routes
- TestPhase101BoardwalkExports: ContentType and SetSecurityHeaders

modules/boardwalk/boardwalk_test.go

@@ -453,3 +453,40 @@ func TestPhase10BoardwalkServing(t *testing.T) {
 		}
 	})
 }
+
+// TestPhase101BoardwalkExports covers the two helpers cabana reuses for
+// plugin assets (Phase 10.1 D-16): ContentType's explicit JavaScript and CSS
+// types and its fallbacks, and SetSecurityHeaders' full admin header set.
+func TestPhase101BoardwalkExports(t *testing.T) {
+	for name, want := range map[string]string{
+		"assets/js/lookup.js":    "text/javascript; charset=utf-8",
+		"assets/js/lookup.MJS":   "text/javascript; charset=utf-8",
+		"assets/css/gadgets.css": "text/css; charset=utf-8",
+		"fonts/inter.woff2":      "font/woff2",
+		"file.no-such-extension": "application/octet-stream",
+		"no-extension":           "application/octet-stream",
+	} {
+		if got := ContentType(name); got != want {
+			t.Fatalf("ContentType(%q) = %q, want %q", name, got, want)
+		}
+	}
+
+	h := http.Header{}
+	h.Set("Content-Security-Policy", "default-src *")
+	SetSecurityHeaders(h)
+	want := map[string]string{
+		"X-Content-Type-Options":  "nosniff",
+		"Referrer-Policy":         "same-origin",
+		"X-Frame-Options":         "DENY",
+		"Content-Security-Policy": "frame-ancestors 'none'; base-uri 'none'; object-src 'none'; script-src 'self'",
+		"X-Robots-Tag":            "noindex, nofollow",
+	}
+	if len(h) != len(want) {
+		t.Fatalf("headers = %v", h)
+	}
+	for key, value := range want {
+		if got := h.Values(key); len(got) != 1 || got[0] != value {
+			t.Fatalf("%s = %v, want %q", key, got, value)
+		}
+	}
+}