3D armour from your content folder, animations that hold their last frame, and security fixes

• 3D armour can be hand-authored in your content folder, drawn by core shaders. Plugins can reach it through engine.armor().
• Animations can stay on their last frame instead of going back to rest, and keep that pose across restarts. Use it for doors, or a plant that grows in stages.
• Items can have a separate first-person model.
• Studio HUDs can live in a content folder.
• Plugins can place a content model.
• Fixed: people sat a third of a block above a chair's seat.
• Fixed: a scaled model sank into the block it stood on.
• Fixed: a wide model's hitbox stopped another being placed in the block beside it.
• Fixed: HUDs on the boss bar lost their fonts on Paper.
• Hardening: pushed links must be https and downloads are capped. Skin fetches only go to Mojang. The pack host has timeouts and per-address limits. Dialog ids and addon content can't leave their folders. Stored containers only load known item classes.