go-milter: build it patched not to keep every header

The security documentation's last open item of panel-dkim-signing (the
owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a
session to a map of its own, emptied only on ABORT, and handed it to
Headers - which no milter of the panel reads. Postfix bounds one header,
not their number, so a message of nothing but headers up to the message
size limit was held whole by the library in the sender check, the signer
and the journal milter on 465/587 and in the inbound journal milter on port
25, where strangers send; the signer's 1 MiB refusal came after it was all
in.

third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause,
LICENSE kept) with session.go changed: CodeHeader hands the header to
Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md
says what and why, and how to take a new upstream version. go.mod replaces
the module with it; the Dockerfile copies third_party before "go mod
download". TestTheLibraryKeepsNoHeaders holds it through the library's own
client over two messages of one connection. Comments, security.md (the
accepted risk becomes a note), development.md's library table, the plan and
CHANGELOG follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/sender.go

@@ -331,10 +331,11 @@ func (s *senderSession) Header(name, value string, m *milter.Modifier) (milter.R
 // message, and src/smtpd/smtpd.c, common_post_message_handling(), says that
 // reply to the client.
 //
-// h is not read: go-milter v0.4.1 adds every header of the connection to it
-// and empties it only on ABORT (session.go, CodeHeader, CodeAbort), so on a
-// second message it can still hold the first one's From:. The session keeps
-// its own, emptied at each MAIL FROM (audit 2026-10-12, L9).
+// h is not read, and is empty: upstream go-milter v0.4.1 added every header
+// of the connection to it and emptied it only on ABORT, so on a second
+// message it could still hold the first one's From: (audit 2026-10-12, L9);
+// the copy SelfPost builds keeps none (third_party/go-milter/PATCHES.md). The
+// session keeps its own, emptied at each MAIL FROM.
 func (s *senderSession) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
 	field, shown, why, err := s.judge()
 	if err != nil {