[security] need to sanitize plot_indicators.csv$plotting_function_call

[7yl4r]

The addition of custom plotter functions currently evals the cell contents directly or code from an arbitrary brew file (see R/get_plotting_function_brew.R).

The risk here is that running create_info_site without carefully inspecting plot_indicators.csv and any .brew templates referenced therein might lead one to execute unexpected R code. It's no worse than copy-pasting an R script from the internet in the first place, but it's worth noting that we could improve this by sanitizing the input or running it in some sort of sandbox.

• simple sandbox example
• rapporter sandboxR lib