feat(12.1-02): writable foreign keys, locked relation options, invisible columns

- FieldRelationContract.WritableForeignKey makes a belongsTo field over a
  protected foreign key writable; the protected key list is unchanged
- cabana.RelationLockProvider names related ids an administrator may not add
  or remove: options and labels carry locked, and a create or update that
  changes the locked subset is 403 before any row is written
- columns.yaml invisible keeps a column searchable and out of the rows
- a controller implementing pact.FilterOptions serves a scope filter's
  choices before the model
- SPA: locked chips and options in RelationField, DataTable skips invisible
  columns
- README, docs, OpenAPI document, TS types and dist updated

admin/tests/fixtures/roster.list-schema.json

@@ -14,7 +14,8 @@
     "assets": { "scripts": [], "styles": [] },
     "columns": [
       { "key": "name", "label": "Name", "searchable": true, "sortable": true },
-      { "key": "email", "label": "Email", "searchable": true, "sortable": true }
+      { "key": "email", "label": "Email", "searchable": true, "sortable": true, "invisible": true },
+      { "key": "slug", "label": "Slug", "searchable": false, "sortable": true }
     ],
     "filters": [],
     "rowActions": [],