feat: go-cs3apis update + immutable attribute + container permissions

[flash7777]

Summary

Two features + go-cs3apis update in one PR:

1. go-cs3apis update (Jun 2026)

Bumps go-cs3apis to include cs3org/cs3apis#272 and Labels API migration.

Before:  opencloud -> Gateway -> StorageProvider (ProviderAPI.AddLabel)
After:   opencloud -> Gateway -> StorageProvider (LabelsAPI.AddLabel)

StorageProvider registers as LabelsAPIServer. Gateway routes via new LabelsAPIClient.

2. Immutable attribute (freeze/protect)

Persistent xattr (user.oc.immutable) on resources:

• File (freeze): content fixed, irreversible
• Container (protect): structure fixed, reversible by managers
• Self vs parent rule: Frozen / Protected / None

3. Container-specific permissions

DeleteContainer / MoveContainer separate file and directory operations.
SetImmutableFile / SetImmutableContainer control who can freeze/protect.

Changes

• go.mod: bump go-cs3apis
• Labels: StorageProvider as LabelsAPIServer, Gateway wiring via pool
• decomposedfs: immutable xattr, handler checks (Delete/Move/CreateDir/Upload)
• Node: FreezeFile, ProtectContainer, UnprotectContainer, GetImmutableState
• Roles: DeleteContainer/MoveContainer on Editor+, SetImmutable on Manager+
• ACL: +dc/!dc, +mc/!mc, +if/+ic encoding
• WebDAV: oc:immutable property, D/NV strip
• GRPC: SetImmutable/UnsetImmutable handlers
• 21 new tests

Test plan

• Full build passes
• 21 new tests pass (node, handler, grants ACL)
• CI pipeline
• Labels (favorites) end-to-end
• Immutable: set on dir, verify children protected

[flash7777]

Note: This PR adds the storage-level infrastructure for immutable resources. Follow-up PRs for the Graph API layer (new LibreGraph actions for container/delete, container/move, immutable/file/set, immutable/container/set) and the web frontend (frozen/protected icons, canBeDeleted/canRename integration) are ready on separate branches and will be submitted after this PR is merged.

[flash7777]

Update: unit tests added + OpenCloud compatibility note

New commit: role permission tests

Added unit tests verifying that container-specific permissions are correctly assigned to roles:

• Editor/SpaceEditor: DeleteContainer + MoveContainer (no SetImmutable)
• Manager/Coowner: all new permissions including SetImmutableFile + SetImmutableContainer
• Viewer: none of the new permissions
• SufficientPermissions: Manager >= Editor, Editor < Manager

Required OpenCloud change after merge

After merging this PR, OpenCloud's services/graph/pkg/service/v0/follow.go must be updated because the Labels API moved from provider to labels package:

// Add import:
labels "github.com/cs3org/go-cs3apis/cs3/labels/v1beta1"

// Change (line ~64):
req := &labels.AddLabelRequest{...}    // was: provider.AddLabelRequest

// Change (line ~133):
req := &labels.RemoveLabelRequest{...} // was: provider.RemoveLabelRequest

Without this change, OpenCloud will fail to compile after updating go-cs3apis.