feat(10.1-01): serve controller JS/CSS and run registered toolbar actions

- boardwalk exports ContentType and SetSecurityHeaders
- pact.AdminClientAssets files are read and hashed at boot and served by exact
  key under {prefix}/assets/{vendor}/{plugin}/ with nosniff, CSP, CORP,
  no-cache and an ETag; a miss falls through to the SPA
- list and form schemas carry assets URLs with a ?v= hash
- toolbar.buttons resolves create, delete and registered actions after decode;
  toolbarActions is permission-filtered per admin
- POST .../toolbar/{action} behind requireAjax and action permissions

admin/tests/fixtures/settings.json

@@ -75,6 +75,10 @@
       "meta": {
         "locale": "en"
       },
+      "assets": {
+        "scripts": [],
+        "styles": []
+      },
       "redirects": {
         "create": {
           "redirect": "",

admin/tests/fixtures/widgets.form-schema.json

@@ -143,6 +143,10 @@
     "meta": {
       "locale": "en"
     },
+    "assets": {
+      "scripts": [],
+      "styles": []
+    },
     "redirects": {
       "create": {
         "redirect": "acme/demo/widgets/update/:id",

admin/tests/fixtures/widgets.list-schema.json

@@ -10,6 +10,8 @@
     "searchTerm": "",
     "recordUrl": "acme/demo/widgets/update/:id",
     "toolbarButtons": ["create", "delete"],
+    "toolbarActions": [],
+    "assets": { "scripts": [], "styles": [] },
     "columns": [
       { "key": "name", "label": "Name", "searchable": true, "sortable": true },
       { "key": "code", "label": "Code", "searchable": true, "sortable": true },