test(12.2-05): prove relation child and protected file scoping through the router

- acme.deferred fixture plugin over testdata/deferred (test-only), two
  controllers, recording Form and Relation hooks, two admins
- TestRelationChildScope*: every child route answers 404 for another
  parent, a hidden parent and another admin's pending child, changes
  nothing; undeclared toolbar buttons 403 before SQL; pivot whitelist
- TestProtectedFile*: foreign, pending and public files 404; only jpeg,
  png, gif and webp inline; nosniff, no-store and sandbox CSP everywhere

modules/cabana/testdata/deferred/models/part/fields.yaml

@@ -0,0 +1,19 @@
+fields:
+    label:
+        label: Label
+        type: text
+        required: true
+    due_on:
+        label: Due on
+        type: datepicker
+        mode: date
+        minDate: 2020-01-01
+    images:
+        label: Images
+        type: fileupload
+        mode: image
+        useCaption: true
+    sheet:
+        label: Sheet
+        type: fileupload
+        fileTypes: [txt, pdf]