parseModule() should not return a Module instance

[edvald]

It's a bit of a stability/security concern to let plugins return potentially non-compliant objects that are used in the framework. The parseModule() handler should instead return a module config that can be validated, potentially with a free-form key that can be passed back to plugin action handlers.

Plugins would then be responsible for upgrading basic Module objects to more specific subclasses, or we could perhaps add some convenience feature for doing that automatically before passing to action handlers.