feat(12.1-02): permissioneditor field in radio or checkbox mode

- type: permissioneditor with mode radio (1, -1) or checkbox (1); the
  controller serves the options per request through
  cabana.PermissionEditorProvider and reads and stores the values
- a save answers 422 for a non-object, an unknown code or a value outside the
  mode's set and 403 for a changed locked code; stored codes that are not
  offered are kept
- record responses carry the stored permissions as an object
- SPA: PermissionEditorField with sections by tab, locked rows and a read-only
  mode for the preview
- README, docs, OpenAPI document, TS types and dist updated

admin/tests/fixtures/roster.form-schema.json

@@ -9,6 +9,20 @@
       { "name": "password", "type": "password", "label": "Password", "span": "left", "context": ["create", "update"] },
       { "name": "password_confirmation", "type": "password", "label": "Repeat the password", "span": "right", "context": ["create", "update"] },
       { "name": "notify", "type": "checkbox", "label": "Send a welcome message", "default": true, "context": "create" },
+      {
+        "name": "permissions",
+        "type": "permissioneditor",
+        "label": "Permissions",
+        "tab": "Permissions",
+        "context": "update",
+        "mode": "radio",
+        "permissionOptions": [
+          { "code": "posts.edit", "label": "Edit posts", "tab": "Content", "comment": "Change the text of any post." },
+          { "code": "posts.publish", "label": "Publish posts", "tab": "Content" },
+          { "code": "reports.export", "label": "Export reports", "tab": "Reports", "locked": true },
+          { "code": "misc.beta", "label": "Try beta features" }
+        ]
+      },
       { "name": "joined_ip", "type": "text", "label": "Joined from IP address", "context": "preview" }
     ],
     "preview": { "headerPartial": "status" },