Plugin assets, external scripts and CSP overrides

[WithoutPants]

This includes a refactoring of the way the /javascript and /css endpoints work. These endpoints are changed to only return the custom javascript/css values provided in the configuration. Plugin-specific scripts and css files are now accessible via /plugin/{pluginID}/javascript and /plugin/{pluginID}/css respectively.

Assets can now be configured in the plugin yml file using the assets field. The assets field maps URL prefixes to paths relative to the directory containing the plugin configuration file. The assets are available at the /plugin/{pluginID}/assets URL path.

For example:

assets:
  foo: bar
  root: .

This will map URLs to these locations:

• /plugin/foo/assets/foo/file.txt -> {pluginDir}/bar/file.txt
• /plugin/foo/assets/file.txt -> {pluginDir}/file.txt
• /plugin/foo/assets/bar/file.txt -> {pluginDir}/bar/file.txt (via the root entry)

CSP policies script-src, style-src and connect-src may now be added to via the csp field:

csp:
  script-src:
    - http://alloweddomain.com
    
  style-src:
    - http://alloweddomain.com
    
  connect-src:
    - http://alloweddomain.com

The css and javascript fields now accept full external URLs. These URLs will be added to csp.script-src automatically. I tested the sceneCoverCropper plugin with the following modification to the yml file:

ui:
  css:
  - https://cdn.jsdelivr.net/npm/cropperjs@1.6.1/dist/cropper.min.css
  javascript:
  - https://cdn.jsdelivr.net/npm/cropperjs@1.6.1/dist/cropper.min.js
  - sceneCoverCropper.js

It still had errors unrelated to this change, but I confirmed that it loaded the css and js file correctly.