feat(12.1-02): writable foreign keys, locked relation options, invisible columns

- FieldRelationContract.WritableForeignKey makes a belongsTo field over a
  protected foreign key writable; the protected key list is unchanged
- cabana.RelationLockProvider names related ids an administrator may not add
  or remove: options and labels carry locked, and a create or update that
  changes the locked subset is 403 before any row is written
- columns.yaml invisible keeps a column searchable and out of the rows
- a controller implementing pact.FilterOptions serves a scope filter's
  choices before the model
- SPA: locked chips and options in RelationField, DataTable skips invisible
  columns
- README, docs, OpenAPI document, TS types and dist updated

admin/tests/fixtures/roster.list.json

@@ -1,8 +1,8 @@
 {
   "data": [
-    { "id": 1, "name": "Ada Lovelace", "email": "ada@example.test" },
-    { "id": 2, "name": "Bob Stone", "email": "bob@example.test" },
-    { "id": 3, "name": "Cy Young", "email": "cy@example.test" }
+    { "id": 1, "name": "Ada Lovelace", "slug": "ada-lovelace" },
+    { "id": 2, "name": "Bob Stone", "slug": "bob-stone" },
+    { "id": 3, "name": "Cy Young", "slug": "cy-young" }
   ],
   "meta": {
     "page": 1,