Use isnt() instead of ok() in CSRF token tests

I am not fond of the function name, but this way failures will report
got/expected as strings.
Simplify and improve and test the widget helper

It's a pity that there's no good way to use <%= content %> rather than
<%= $content %> inside the widget, but the content buffer named content
is treated as a special case by the renderer, and can't be overwritten
by any public method.
Don't use deprecated _mode methods
Reorder functions according to calling sequence
Allow secrets.conf to specify multiple application secrets

This takes advantage of the recent "secret rotation" support upstream,
but also accepts existing configuration files without complaint.
Set cache-friendly headers for static responses

Files in public/ are marked as cacheable for one year by default.

(This is still untested.)
Set cache-unfriendly headers for dynamic responses

Plus passing tests for cache-control/expires headers for both static and
dynamic responses.
Rename _shadow_controllers to resolve_controllers

It's as enshrined as any gross hack could possibly be, so we might as
well give it some legitimacy through unapologetic commentary.
A little editorialisation
Make this header look like the others
Remove special-case require handling for jquery and jquery-ui
Rename M::P::GadwallHelpers to ::PageConstruction
Omit type="…" for stylesheet and script references
Add cache-busting timestamps to local JS/CSS references
Add a timestamp to /default.css, if it exists

(…and leave it nonexistent for the tests)
Briefly also test the inline css/js helpers
Add a helper script to run the Wigeon app directly

It's handy to test things by hand: e.g. run "t/testlib/wigeon get /t/1".