feat: add `--allow-import` flag (#25469)

This replaces `--allow-net` for import permissions and makes the
security sandbox stricter by also checking permissions for statically
analyzable imports.

By default, this has a value of
`--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`,
but that can be overridden by providing a different set of hosts.

Additionally, when no value is provided, import permissions are inferred
from the CLI arguments so the following works because
`fresh.deno.dev:443` will be added to the list of allowed imports:

```ts
deno run -A -r https://fresh.deno.dev
```

---------

Co-authored-by: David Sherret <dsherret@gmail.com>

1 files changed, 5 insertions, 2 deletions

diff --git a/cli/graph_container.rs b/cli/graph_container.rs
index 211b278e0..c463d71a6 100644
--- a/cli/graph_container.rs
+++ b/cli/graph_container.rs
@@ -9,9 +9,9 @@ use deno_core::error::AnyError;
 use deno_core::parking_lot::RwLock;
 use deno_graph::ModuleGraph;
 use deno_runtime::colors;
+use deno_runtime::deno_permissions::PermissionsContainer;
 
 use crate::args::CliOptions;
-use crate::file_fetcher::FetchPermissionsOption;
 use crate::module_loader::ModuleLoadPreparer;
 use crate::util::fs::collect_specifiers;
 use crate::util::path::is_script_ext;
@@ -45,12 +45,14 @@ pub struct MainModuleGraphContainer {
   inner: Arc<RwLock<Arc<ModuleGraph>>>,
   cli_options: Arc<CliOptions>,
   module_load_preparer: Arc<ModuleLoadPreparer>,
+  root_permissions: PermissionsContainer,
 }
 
 impl MainModuleGraphContainer {
   pub fn new(
     cli_options: Arc<CliOptions>,
     module_load_preparer: Arc<ModuleLoadPreparer>,
+    root_permissions: PermissionsContainer,
   ) -> Self {
     Self {
       update_queue: Default::default(),
@@ -59,6 +61,7 @@ impl MainModuleGraphContainer {
       )))),
       cli_options,
       module_load_preparer,
+      root_permissions,
     }
   }
 
@@ -76,7 +79,7 @@ impl MainModuleGraphContainer {
         specifiers,
         false,
         self.cli_options.ts_type_lib_window(),
-        FetchPermissionsOption::AllowAll,
+        self.root_permissions.clone(),
         ext_overwrite,
       )
       .await?;