feat(12.1-02): permissioneditor field in radio or checkbox mode

- type: permissioneditor with mode radio (1, -1) or checkbox (1); the
  controller serves the options per request through
  cabana.PermissionEditorProvider and reads and stores the values
- a save answers 422 for a non-object, an unknown code or a value outside the
  mode's set and 403 for a changed locked code; stored codes that are not
  offered are kept
- record responses carry the stored permissions as an object
- SPA: PermissionEditorField with sections by tab, locked rows and a read-only
  mode for the preview
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/relation_form.go

@@ -21,6 +21,8 @@ var relationFormRefusedTypes = map[string]bool{
 	"relation": true, "relation-manager": true, "widget": true, "partial": true,
 	// A password is a virtual field, and only an admin controller lists those.
 	"password": true,
+	// A permission editor's options and storage belong to an admin controller.
+	"permissioneditor": true,
 }
 
 // pivotFieldPattern is WinterCMS's pivot form field name, pivot[column].