Secure Liquid authoring and add LiquidField

[sebastienros]

Liquid templates are executable content, while HTML and Markdown should remain ordinary authored source with sanitization applied only to their final rendered output. This implements the Orchard Core 4.0 portion of the long-term separation described in #19817.

Changes

• Adds the security-critical ManageLiquidTemplates permission, grants it to Administrator and Editor by default, preserves existing Editor access through migration, and requires it server-side for Liquid parts, fields, Templates, Admin Templates, and template preview.
• Adds LiquidField with editing, validation, rendering, indexing, GraphQL, migrations, source-safe embedding, and documentation.
• Removes embedded Liquid execution and RenderLiquid settings from HTML and Markdown parts and fields while retaining shortcodes.
• Persists authored HTML and Markdown exactly, then applies the permanent render pipelines consistently across display shapes, previews, body aspects, GraphQL, Razor helpers, and built-in themes:
  • HTML: source -> shortcodes -> optional sanitization
  • Markdown: source -> Markdown conversion -> shortcodes -> optional sanitization
• Hardens HtmlMenuItemPart at the public rendering boundary by sanitizing a clone and rejecting unsafe or malformed URL schemes without mutating stored content.
• Emits warning-level migration guidance for legacy definitions with RenderLiquid enabled without rewriting settings or content.
• Encodes textarea, Monaco, WYSIWYG, JSON, and JavaScript source by context while preserving exact unchanged round trips.

Migration notes

Existing Liquid syntax in HTML and Markdown remains stored but is no longer executed. Definitions that previously enabled RenderLiquid must be migrated manually to LiquidPart or LiquidField; startup warnings identify each affected content type, part, and field.

Validation

• dotnet build src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj -f net10.0 --no-restore
• 30 focused HTML, Markdown, Liquid permission, migration, and menu security tests

Related to #19817.

[github-actions]

This pull request has merge conflicts. Please resolve those before requesting a review.