DI token a menu host provides for sub-component composers (e.g. an
inside-the-menu submenu trigger) that resolve the host via inject().
Triggers that live on a different element pass a template-ref through
an input typed against CngxMenuHost instead - DI across element
boundaries cannot reach the menu.