Limit trusted Composer plugins to a known list, allow user to add more

package_manager.settings configuration now has a additional_trusted_composer_plugins setting, which accepts a list of package names.

The following composer plugins are supported by default:

1. drupal/core-vendor-hardening
2. drupal/core-composer-scaffold
3. drupal/core-project-message
4. dealerdirect/phpcodesniffer-composer-installer
5. phpstan/extension-installer
6. cweagans/composer-patches

An example of an addition:

$config['package_manager.settings']['additional_trusted_composer_plugins'][] = 'some-org/some-composer-plugin';