feat(10.1-01): serve controller JS/CSS and run registered toolbar actions

- boardwalk exports ContentType and SetSecurityHeaders
- pact.AdminClientAssets files are read and hashed at boot and served by exact
  key under {prefix}/assets/{vendor}/{plugin}/ with nosniff, CSP, CORP,
  no-cache and an ETag; a miss falls through to the SPA
- list and form schemas carry assets URLs with a ?v= hash
- toolbar.buttons resolves create, delete and registered actions after decode;
  toolbarActions is permission-filtered per admin
- POST .../toolbar/{action} behind requireAjax and action permissions

modules/cabana/security_coverage_test.go

@@ -51,6 +51,7 @@ var phase09Routes = []adminRoute{
 	{key: "POST /{vendor}/{plugin}/{controller}"},
 	{key: "POST /{vendor}/{plugin}/{controller}/bulk-delete"},
 	{key: "POST /{vendor}/{plugin}/{controller}/widgets/{field}"},
+	{key: "POST /{vendor}/{plugin}/{controller}/toolbar/{action}"},
 	{key: "GET /{vendor}/{plugin}/{controller}/{id}"},
 	{key: "PUT /{vendor}/{plugin}/{controller}/{id}"},
 	{key: "DELETE /{vendor}/{plugin}/{controller}/{id}"},
@@ -58,6 +59,7 @@ var phase09Routes = []adminRoute{
 	{key: "GET /{vendor}/{plugin}/{controller}/{id}/relations/{name}/candidates"},
 	{key: "POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/link"},
 	{key: "POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/unlink"},
+	{key: "GET /assets/{vendor}/{plugin}/{file...}", public: true, spa: true},
 	{key: "GET ", public: true, spa: true},
 	{key: "GET /{path...}", public: true, spa: true},
 }
@@ -266,6 +268,7 @@ func phase09ProtectedCalls() []phase09Call {
 		{"create", (*service).create},
 		{"bulk-delete", (*service).bulkDelete},
 		{"widget-action", (*service).widgetAction},
+		{"toolbar-action", (*service).toolbarAction},
 		{"show", (*service).show},
 		{"update", (*service).update},
 		{"delete", (*service).deleteRecord},