go-milter: build it patched not to keep every header

The security documentation's last open item of panel-dkim-signing (the
owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a
session to a map of its own, emptied only on ABORT, and handed it to
Headers - which no milter of the panel reads. Postfix bounds one header,
not their number, so a message of nothing but headers up to the message
size limit was held whole by the library in the sender check, the signer
and the journal milter on 465/587 and in the inbound journal milter on port
25, where strangers send; the signer's 1 MiB refusal came after it was all
in.

third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause,
LICENSE kept) with session.go changed: CodeHeader hands the header to
Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md
says what and why, and how to take a new upstream version. go.mod replaces
the module with it; the Dockerfile copies third_party before "go mod
download". TestTheLibraryKeepsNoHeaders holds it through the library's own
client over two messages of one connection. Comments, security.md (the
accepted risk becomes a note), development.md's library table, the plan and
CHANGELOG follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

third_party/go-milter/message.go

@@ -0,0 +1,68 @@
+package milter
+
+// Message represents a command sent from milter client
+type Message struct {
+	Code byte
+	Data []byte
+}
+
+type ActionCode byte
+
+const (
+	ActAccept    ActionCode = 'a' // SMFIR_ACCEPT
+	ActContinue  ActionCode = 'c' // SMFIR_CONTINUE
+	ActDiscard   ActionCode = 'd' // SMFIR_DISCARD
+	ActReject    ActionCode = 'r' // SMFIR_REJECT
+	ActTempFail  ActionCode = 't' // SMFIR_TEMPFAIL
+	ActReplyCode ActionCode = 'y' // SMFIR_REPLYCODE
+
+	// [v6]
+	ActSkip ActionCode = 's' // SMFIR_SKIP
+)
+
+type ModifyActCode byte
+
+const (
+	ActAddRcpt      ModifyActCode = '+' // SMFIR_ADDRCPT
+	ActDelRcpt      ModifyActCode = '-' // SMFIR_DELRCPT
+	ActReplBody     ModifyActCode = 'b' // SMFIR_ACCEPT
+	ActAddHeader    ModifyActCode = 'h' // SMFIR_ADDHEADER
+	ActChangeHeader ModifyActCode = 'm' // SMFIR_CHGHEADER
+	ActInsertHeader ModifyActCode = 'i' // SMFIR_INSHEADER
+	ActQuarantine   ModifyActCode = 'q' // SMFIR_QUARANTINE
+
+	// [v6]
+	ActChangeFrom ModifyActCode = 'e' // SMFIR_CHGFROM
+)
+
+type Code byte
+
+const (
+	CodeOptNeg Code = 'O' // SMFIC_OPTNEG
+	CodeMacro  Code = 'D' // SMFIC_MACRO
+	CodeConn   Code = 'C' // SMFIC_CONNECT
+	CodeQuit   Code = 'Q' // SMFIC_QUIT
+	CodeHelo   Code = 'H' // SMFIC_HELO
+	CodeMail   Code = 'M' // SMFIC_MAIL
+	CodeRcpt   Code = 'R' // SMFIC_RCPT
+	CodeHeader Code = 'L' // SMFIC_HEADER
+	CodeEOH    Code = 'N' // SMFIC_EOH
+	CodeBody   Code = 'B' // SMFIC_BODY
+	CodeEOB    Code = 'E' // SMFIC_BODYEOB
+	CodeAbort  Code = 'A' // SMFIC_ABORT
+	CodeData   Code = 'T' // SMFIC_DATA
+
+	// [v6]
+	CodeQuitNewConn Code = 'K' // SMFIC_QUIT_NC
+)
+
+const MaxBodyChunk = 65535
+
+type ProtoFamily byte
+
+const (
+	FamilyUnknown ProtoFamily = 'U' // SMFIA_UNKNOWN
+	FamilyUnix    ProtoFamily = 'L' // SMFIA_UNIX
+	FamilyInet    ProtoFamily = '4' // SMFIA_INET
+	FamilyInet6   ProtoFamily = '6' // SMFIA_INET6
+)