go-milter: build it patched not to keep every header

The security documentation's last open item of panel-dkim-signing (the
owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a
session to a map of its own, emptied only on ABORT, and handed it to
Headers - which no milter of the panel reads. Postfix bounds one header,
not their number, so a message of nothing but headers up to the message
size limit was held whole by the library in the sender check, the signer
and the journal milter on 465/587 and in the inbound journal milter on port
25, where strangers send; the signer's 1 MiB refusal came after it was all
in.

third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause,
LICENSE kept) with session.go changed: CodeHeader hands the header to
Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md
says what and why, and how to take a new upstream version. go.mod replaces
the module with it; the Dockerfile copies third_party before "go mod
download". TestTheLibraryKeepsNoHeaders holds it through the library's own
client over two messages of one connection. Comments, security.md (the
accepted risk becomes a note), development.md's library table, the plan and
CHANGELOG follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/panel-dkim-signing.md

@@ -210,11 +210,10 @@ libmilter1.0.1.
 the reviews ran on stages 1-2 and their findings are fixed in `c2f63d2`,
 with the first rollout's incident (the queue's owner numbers); the
 documents in the commit after it. `Sender:` is held to the login like
-`From:` (security review F1; the owner's decision, 2026-10-16). Open:
-go-milter v0.4.1 keeping
-every header in a map of its own per session (security.md, accepted risks)
-- a header section the signer refuses past 1 MiB is still held by the
-library, on 465/587 and on port 25 alike, as before 2.8.0.
+`From:` (security review F1; the owner's decision, 2026-10-16). go-milter
+v0.4.1 kept every header in a map of its own per session, on 465/587 and on
+port 25 alike: the panel builds it patched not to
+(`third_party/go-milter/PATCHES.md`; the owner's decision, 2026-10-16).
 - [ ] On the test server: a day of the owner's mail; one message from an
   application through 465 and one notification to a real mailbox, the
   headers read (dkim=pass with the panel's `d=`).