A definition names no host path for its own data

Twenty-eight modules' data directories are placed: the root as place ".", a sub-directory named by
its id, and every host-side reference — binds, secrets, own secrets, grants, receives, file paths,
mounts, env-files — as ${dir:<id>}. Resolved on the default root every path is the one the manifest
named before, which the controller's TestPlacedDirectoriesKeepTheirPaths proves over both checkouts;
so no data moves and no machine sees a change. Five directories whose id is not their last segment
keep their path as a placement (novox/hq issue 119, ADR 0112, design 27).

modules/gitlab/module.json

@@ -2,7 +2,7 @@
   "module": "gitlab",
   "version": "1",
   "own-secrets": {
-    "token": "/var/lib/gitlab/token",
+    "token": "${dir:state}/token",
     "broker": "/var/lib/mesh/gitlab/broker"
   },
   "resources": [
@@ -15,13 +15,13 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/gitlab",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "config",
       "type": "file",
-      "path": "/var/lib/gitlab/config.json",
+      "path": "${dir:state}/config.json",
       "merge": "json",
       "content": "{}",
       "mode": "0600"
@@ -32,8 +32,8 @@
       "name": "mesh-runtime-gitlab",
       "network": "host",
       "volumes": [
-        "/var/lib/gitlab/config.json:/run/config/config.json:ro",
-        "/var/lib/gitlab/token:/run/secrets/token:ro",
+        "${dir:state}/config.json:/run/config/config.json:ro",
+        "${dir:state}/token:/run/secrets/token:ro",
         "/var/lib/mesh/gitlab/broker:/run/secrets/broker:ro"
       ],
       "env": {