Accept and ignore a file's trusted, and give each runtime its own time to answer

The fourth review (hq issue 339): `trusted` is the catalogue's word and the
controller takes it out, but a controller that passes it on, an older one or
one rolled back to, must not cost a node its whole declaration. A file now
accepts it and nothing reads it; any other resource still refuses it. And a
podman that hangs no longer eats docker's ten seconds.

internal/declaration/trusted_test.go

@@ -0,0 +1,23 @@
+package declaration
+
+import "testing"
+
+// `trusted` is the catalogue's word on a file (novox/hq issue 339): a controller takes it out before it sends a
+// declaration, and one that does not — an older one, or one rolled back to — must not cost the node its whole
+// declaration. So a file accepts it and the engine does nothing with it; any other resource still refuses it.
+func TestAFileAcceptsAndIgnoresTrusted(t *testing.T) {
+	for _, v := range []string{"true", "false"} {
+		d, err := Parse([]byte(`{"declaration":1,"resources":[{"id":"m.f","type":"file","path":"/etc/m.conf",` +
+			`"content":"x","trusted":` + v + `}]}`))
+		if err != nil {
+			t.Fatalf("trusted %s: %v", v, err)
+		}
+		if f, ok := d.Resources[0].(*File); !ok || f.Content != "x" {
+			t.Fatalf("trusted %s: %+v", v, d.Resources[0])
+		}
+	}
+	if _, err := Parse([]byte(`{"declaration":1,"resources":[{"id":"m.d","type":"directory","path":"/srv/m",` +
+		`"trusted":true}]}`)); err == nil {
+		t.Fatal("a directory took trusted")
+	}
+}