Signs each stored snippet on the way in, so the compiler can tell what this application wrote.
MishkaCmsCore.Runtime.PageBuilder.CodeSignature holds the rule and is off unless a key is
configured; with no key this change is a no-op and nothing about the row changes.
Why here rather than at each caller
There are five ways code reaches these attributes — the builder, the Gervaz form, the JSON:API, a seed and the kit installer — and a signature applied at four of them is worth nothing, because the fifth is the one an attacker would use. The action boundary is the only place all five pass through.
It runs on the same four resources as Validations.CodeChange, and after it: there is no point
signing a write that is about to be refused.