Added denial test + route comment + SECURITY.md note proving anonymous users can't resolve an unpublished node's layout. No behavior change.
▎ Drupal 12 compatibility release. Core compatibility widened to ^10 || ^11 || ^12. No functional changes.
Fix layout resolver Content-Type to application/json; expanded test coverage; CI/security scanning + docs updates.
- Initial release. - Adds GET /jsonapi/layout/resolve?path=... (resolver contract + layout tree when applicable). - MVP supports field blocks + inline blocks (returns JSON:API refs for block_content). - Requires jsonapi_frontend + core layout_builder + core block_content.