Redirect the other www spelling to SITE_ORIGIN, hold roles to the role help and fix the audit findings

SITE_ORIGIN alone decides whether the site is www or not: CanonicalHostSubscriber
sends the other spelling there with 301, cms:site:origin writes the setting, the
system screen shows it. The roles now match the role help (editor: drafts,
publisher: live content, admin: design, settings, users, system). The installer no
longer reopens on an unreachable database, the session cookie follows ADMIN_PATH,
percent-encoded credentials no longer break the container, consent only accepts
same-site decisions, JSON-LD is HTML-safe, own CSS stays in its block, plus the
editor, updater, download and public-output findings from the full review
(ADR 099, ADR 100).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/Controller/EditorController.php

@@ -286,6 +286,11 @@ final class EditorController extends AbstractController
             return $this->back('Deine Sitzung ist abgelaufen. Bitte melde dich erneut an.');
         }
         try {
+            // Dieselbe Regel wie beim Speichern: Skripte aendert nur ein Administrator - auch nicht
+            // ueber den Umweg einer alten Fassung.
+            if (!$this->isGranted('ROLE_ADMIN')) {
+                $this->code->assertScriptsUnchanged($this->pages->revisionDocument($id, $revision), $this->pages->findForEditor($id)['document']);
+            }
             $this->pages->restoreRevision($id, $revision, $request->request->getInt('expectedVersion', -1));
         } catch (InvalidPage|StaleWrite $e) {
             return $this->back($e->getMessage());