Tracking issue for reinstating plugin sandboxes

After #214 removed the Starlark-powered plugin sandbox, the security posture of the project has become worse, and the recent addition of third-party repo support didn't help.

Since the original decision was based on a non-technical ground (ease of onboarding), it's not clear whether an exception would be granted for the plugins, or whether the grounds have shifted. A tracking issue is here to collect information and serve as a sync point.