Declarative allow-list of slate block & inline styles (DS-constrained authoring)

[djay]

Problem

There's no way for a frontend (or a design system) to declare which slate block-level and inline styles are allowed, and have hydra enforce that allow-list across every authoring surface.

Concrete case: the NSW Design System has no blockquote (no component, no typography — confirmed against the DS src+dist). But in the hydra admin, blockquote is a first-class slate style with four independent entry points, so there's no clean way to turn it off:

1. Toolbar button — volto-slate hardcodes config.settings.slate.toolbarButtons to a list that includes 'blockquote' (volto-slate/src/index.js).
2. Paste / deserialize — volto-slate/src/editor/config.jsx: BLOCKQUOTE: blockTagDeserializer('blockquote') — paste a <blockquote> from a webpage/Word and it survives.
3. Blockquote plugin — registers the element + button + pushes into expandedToolbarButtons.
4. Slash menu — this one already honours a per-field allowedBlocks (blocks/Text/SlashMenu.jsx), so the infra is partially there.

Hiding the toolbar button (e.g. via voltoConfig deep-merging settings.slate.toolbarButtons) is only cosmetic — the format still enters via paste.

Proposed feature

A declarative allow-list of slate styles the frontend/DS can pass (via voltoConfig / per-slate-field schema), enforced uniformly by hydra:

• Block-level formats (headings, lists, blockquote, …) and inline marks (bold, italic, underline, strikethrough, sub/sup, …).
• Enforced across toolbar, slash menu, paste/deserialize, and hotkeys/markdown shortcuts — not just the toolbar.
• Normalize on load/paste: nodes/marks outside the allow-list are downgraded (e.g. blockquote → p) rather than silently kept, so existing content is migrated. (There is currently exactly one such node in the NSW distribution — a blockquote tagline in /nswbranding/onecx — which this normalization would convert.)

Acceptance

• A DS can declare its allowed block + inline styles once; disallowed styles are un-authorable from every surface.
• Pasting disallowed markup yields allowed nodes only.
• Existing disallowed nodes normalize on load.

Context

Surfaced while giving the NSW DS callout the full treatment; blockquote-disable was split out of that PR into this feature. Interim: no settings hack shipped — blockquote-disable waits for this.

[djay]

Note from real-usage research: the nsw.gov.au OneCX CMS component catalogue lists Blockquote as its own Featured-Content component (/cms-component-catalogue/blockquote), separate from the inline slate blockquote format. So 'blockquote' as a distinct styled block may be legitimate for NSW even though the base nsw-design-system package ships no blockquote. This feature is about the inline slate format (toolbar/paste/etc.); a standalone Blockquote block is a separate modelling question.