Add Options.FSRoot to bound pom.xml parent resolution

[andrew]

Depends on git-pkgs/pom#10.

pomXMLParser is the only parser that touches the filesystem: it follows <parent><relativePath> via pom.LocalFetcher so multi-module projects resolve ${project.version} and parent-defined properties. Server-side that means a pushed pom.xml can read arbitrary files relative to the process working directory.

This adds manifests.Options{FSRoot string} and threads it through a new core.FSRootParser interface that only pomXMLParser implements. With FSRoot empty (the default, and what existing Parse(filename, content) calls get), parsing is a pure function of content and the parent walk is skipped. With FSRoot set, parent lookup is jailed to that directory by the upstream pom.NewLocalFetcherFrom change.

Parse keeps its existing signature via a variadic opts ...Options so current callers compile unchanged; they lose multi-module parent resolution until they pass Options{FSRoot: repoRoot}.

go.mod currently carries a replace github.com/git-pkgs/pom => ../pom directive so this builds against the unreleased API. That will be swapped for a tagged version once pom#10 is released, before this comes out of draft.