go-milter: build it patched not to keep every header

The security documentation's last open item of panel-dkim-signing (the
owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a
session to a map of its own, emptied only on ABORT, and handed it to
Headers - which no milter of the panel reads. Postfix bounds one header,
not their number, so a message of nothing but headers up to the message
size limit was held whole by the library in the sender check, the signer
and the journal milter on 465/587 and in the inbound journal milter on port
25, where strangers send; the signer's 1 MiB refusal came after it was all
in.

third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause,
LICENSE kept) with session.go changed: CodeHeader hands the header to
Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md
says what and why, and how to take a new upstream version. go.mod replaces
the module with it; the Dockerfile copies third_party before "go mod
download". TestTheLibraryKeepsNoHeaders holds it through the library's own
client over two messages of one connection. Comments, security.md (the
accepted risk becomes a note), development.md's library table, the plan and
CHANGELOG follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

third_party/go-milter/milter.go

@@ -0,0 +1,57 @@
+// Package milter provides an interface to implement milter mail filters
+package milter
+
+// OptAction sets which actions the milter wants to perform.
+// Multiple options can be set using a bitmask.
+type OptAction uint32
+
+// Set which actions the milter wants to perform.
+const (
+	OptAddHeader    OptAction = 1 << 0 // SMFIF_ADDHDRS
+	OptChangeBody   OptAction = 1 << 1 // SMFIF_CHGBODY
+	OptAddRcpt      OptAction = 1 << 2 // SMFIF_ADDRCPT
+	OptRemoveRcpt   OptAction = 1 << 3 // SMFIF_DELRCPT
+	OptChangeHeader OptAction = 1 << 4 // SMFIF_CHGHDRS
+	OptQuarantine   OptAction = 1 << 5 // SMFIF_QUARANTINE
+
+	// [v6]
+	OptChangeFrom      OptAction = 1 << 6 // SMFIF_CHGFROM
+	OptAddRcptWithArgs OptAction = 1 << 7 // SMFIF_ADDRCPT_PAR
+	OptSetSymList      OptAction = 1 << 8 // SMFIF_SETSYMLIST
+)
+
+// OptProtocol masks out unwanted parts of the SMTP transaction.
+// Multiple options can be set using a bitmask.
+type OptProtocol uint32
+
+const (
+	OptNoConnect  OptProtocol = 1 << 0 // SMFIP_NOCONNECT
+	OptNoHelo     OptProtocol = 1 << 1 // SMFIP_NOHELO
+	OptNoMailFrom OptProtocol = 1 << 2 // SMFIP_NOMAIL
+	OptNoRcptTo   OptProtocol = 1 << 3 // SMFIP_NORCPT
+	OptNoBody     OptProtocol = 1 << 4 // SMFIP_NOBODY
+	OptNoHeaders  OptProtocol = 1 << 5 // SMFIP_NOHDRS
+	OptNoEOH      OptProtocol = 1 << 6 // SMFIP_NOEOH
+	OptNoUnknown  OptProtocol = 1 << 8 // SMFIP_NOUNKNOWN
+	OptNoData     OptProtocol = 1 << 9 // SMFIP_NODATA
+
+	// [v6] MTA supports ActSkip
+	OptSkip OptProtocol = 1 << 10 // SMFIP_SKIP
+	// [v6] Filter wants rejected RCPTs
+	OptRcptRej OptProtocol = 1 << 11 // SMFIP_RCPT_REJ
+
+	// Milter will not send action response for the following MTA messages
+	OptNoHeaderReply OptProtocol = 1 << 7 // SMFIP_NR_HDR, SMFIP_NOHREPL
+	// [v6]
+	OptNoConnReply    OptProtocol = 1 << 12 // SMFIP_NR_CONN
+	OptNoHeloReply    OptProtocol = 1 << 13 // SMFIP_NR_HELO
+	OptNoMailReply    OptProtocol = 1 << 14 // SMFIP_NR_MAIL
+	OptNoRcptReply    OptProtocol = 1 << 15 // SMFIP_NR_RCPT
+	OptNoDataReply    OptProtocol = 1 << 16 // SMFIP_NR_DATA
+	OptNoUnknownReply OptProtocol = 1 << 17 // SMFIP_NR_UNKN
+	OptNoEOHReply     OptProtocol = 1 << 18 // SMFIP_NR_EOH
+	OptNoBodyReply    OptProtocol = 1 << 19 // SMFIP_NR_BODY
+
+	// [v6]
+	OptHeaderLeadingSpace OptProtocol = 1 << 20 // SMFIP_HDR_LEADSPC
+)