fix(09): WR-03 refuse writes that the compiled list and form do not declare

modules/cabana/security_coverage_test.go

@@ -294,7 +294,11 @@ func phase09DeniedService() *service {
 	controller := orderController{perms: []string{"acme.demo.access"}}
 	return &service{reg: &Registry{
 		byID: map[string]*CompiledController{
-			"acme.demo.widgets": {Controller: controller, Relations: map[string]*CompiledRelation{}},
+			"acme.demo.widgets": {
+				Controller: controller, Relations: map[string]*CompiledRelation{},
+				// Declare every write so the denial under test is the permission.
+				Form: &FormSchema{}, List: &ListSchema{ToolbarButtons: []string{"create", "delete"}},
+			},
 		},
 		settings: map[string]*CompiledSetting{
 			"demo": {Item: pact.SettingsItem{Code: "demo", Permissions: []string{"acme.demo.manage_settings"}}},