1.2.0-alpha1: ESI render element on top of 1.1's private cache

First alpha of the 1.2.x track. Adds a new render element type
'lscache_esi' that emits an <esi:include src="..." /> tag pointing
at a fragment route, plus the fragment route itself, plus an
HMAC-SHA256 token signer that gates fragment access.

Drupal-native: 'lscache_esi' accepts the same #callback and #args
shape as #lazy_builder. A render-array author who already knows how
to write a lazy builder can promote it to an ESI fragment with one
key change. The surrounding response stays public-cacheable because
the per-user variation is pushed out to the fragment, and the
fragment itself emits private-cache headers picked up by 1.1's
response subscriber.

Token format is base64url(json-payload).hex(hmac-sha256), keyed on
the site's hash salt. Tampering, replaying, or signing with a
different salt all fail verification cleanly. Every fragment also
carries an 'lscache_esi' cache tag so a single invalidation drains
every fragment site-wide.