#129 Don't silently strip unknown fields in content and user zod schemas

[jmevissen]

Problem

Change notes entered in the @@edit form never reached the version history.
The edit route forwards the note correctly — the loss happens in
@plone/client: updateContent builds the PATCH body from the zod-parsed
args, and zod's default object mode silently strips every key the schema does
not declare. changeNote was not declared, so it was dropped before the
request was sent.

This affected more than the change note: any field not whitelisted in
createContentDataSchema/updateContentDataSchema was discarded on save —
including all fields of custom dexterity types. The user schemas had the same
issue for custom member properties.

Change

• createContentDataSchema / updateContentDataSchema: added .passthrough()
  and declared changeNote.
• createUserDataSchema / updateUserDataSchema: added .passthrough().

Declared fields are still validated exactly as before (a mistyped declared
field still throws); .passthrough() only stops unknown keys from being
stripped, leaving the backend as the authority on which fields exist.
Schemas for fixed-protocol payloads (copy/move, comments, workflow) are
deliberately unchanged, and registry.ts already used z.record.

Tests

• src/validation/passthrough.test.ts: unit tests — unknown fields survive
  parsing on content and user schemas, declared fields still validated.
• src/restapi/content/update.test.ts: integration test asserting the
  changeNote lands as the version comment in @history.

Caution

The Volto Team has suspended its review of new pull requests from first-time contributors until the release of Plone 7, which is preliminarily scheduled for the second quarter of 2026.
Read details.

---

• I signed and returned the Plone Contributor Agreement, and received and accepted an invitation to join a team in the Plone GitHub organization.
• I verified there aren't other open pull requests for the same change.
• I followed the guidelines in Contributing to Volto.
• I succesfully ran code linting checks on my changes locally.
• I succesfully ran unit tests on my changes locally.
• I succesfully ran acceptance tests on my changes locally.
• If needed, I added new tests for my changes.
• If needed, I added documentation for my changes, either in the Storybook or narrative documentation.
• I included a change log entry in my commits.

---

If your pull request closes an open issue, include the exact text below, immediately followed by the issue number. When your pull request gets merged, then that issue will close automatically.

Closes #129

[pnicolli]

I gave this a little bit of extra thought and came up with a few changes I would make. Overall, this is very much needed, thanks!