Secure Liquid authoring and rendered HTML in 3.x

[sebastienros]

Liquid-enabled HTML and Markdown currently mix trusted template authoring with ordinary content editing, while sanitization at persistence time can mutate source and leave existing records or alternate rendering paths exposed. This backports the 3.x-compatible security model while retaining Liquid, LiquidPart, and RenderLiquid behavior.

Changes

• Adds the security-critical ManageLiquidTemplates permission, grants it to Administrator and Editor stereotypes, and migrates existing Editor roles without overwriting customized descriptions.
• Enforces Liquid authorization server-side for LiquidPart, Templates, Admin Templates, preview, RenderLiquid definition settings, REST and MetaWeblog mutations, including recursively embedded content.
• Preserves exact authored HTML and Markdown, then sanitizes final rendered output after Liquid, Markdown conversion, and shortcodes across display shapes, BodyAspect, and GraphQL.
• Hardens HTML menu rendering by sanitizing a clone at the public MenuItemLink boundary and rejecting unsafe or malformed URL schemes without mutating persisted content.
• Context-encodes editor source and JavaScript configuration while preserving round-tripping.
• Adds focused permission, mutation, rendering-order, menu, persistence, sanitizer opt-out, and source-encoding coverage, plus canonical documentation updates.

This intentionally does not include the 4.0 removal of Liquid or LiquidField.