Derive data protection from a module's declared data (hq ADR 0233)

A module's data section says what it keeps and how precious it is; the backup holder's lines,
binding stickiness, retirement on unassign and D13's conditions follow from it, so issue 273's
empty replacement is said and an unassigned module's data is remembered, not forgotten.

internal/link/retirement.go

@@ -233,10 +233,13 @@ type RetirementRejected struct {
 
 // RetirementState is a provider's answer to provisioner_retirement.
 type RetirementState struct {
-	Resource     string   `json:"resource"`
-	Node         string   `json:"node"`
-	Held         []string `json:"held"`
-	StablePasses int      `json:"stable_passes"`
+	Resource string   `json:"resource"`
+	Node     string   `json:"node"`
+	Held     []string `json:"held"`
+	// HeldSizes is what each held consumer keeps on the backend, in bytes, where the backend can say
+	// (novox/hq ADR 0233): what an empty replacement of a consumer's data is told by.
+	HeldSizes    map[string]int64 `json:"held_sizes,omitempty"`
+	StablePasses int              `json:"stable_passes"`
 	// StableForSeconds is how long the same unasked set must hold as well (ADR 0230: ten minutes).
 	StableForSeconds int `json:"stable_for_seconds,omitempty"`
 	// RetiresBy is "disable", or "mark-only" for a provider that cannot disable a consumer.