feat: add `--allow-import` flag (#25469)

This replaces `--allow-net` for import permissions and makes the
security sandbox stricter by also checking permissions for statically
analyzable imports.

By default, this has a value of
`--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`,
but that can be overridden by providing a different set of hosts.

Additionally, when no value is provided, import permissions are inferred
from the CLI arguments so the following works because
`fresh.deno.dev:443` will be added to the list of allowed imports:

```ts
deno run -A -r https://fresh.deno.dev
```

---------

Co-authored-by: David Sherret <dsherret@gmail.com>

5 files changed, 39 insertions, 0 deletions

diff --git a/tests/specs/info/import_map/__test__.jsonc b/tests/specs/info/import_map/__test__.jsonc
new file mode 100644
index 000000000..725276925
--- /dev/null
+++ b/tests/specs/info/import_map/__test__.jsonc
@@ -0,0 +1,5 @@
+{
+  "args": "info preact/debug",
+  "output": "with_import_map.out",
+  "exitCode": 0
+}
diff --git a/tests/specs/info/import_map/deno.json b/tests/specs/info/import_map/deno.json
new file mode 100644
index 000000000..aaf7260c6
--- /dev/null
+++ b/tests/specs/info/import_map/deno.json
@@ -0,0 +1,6 @@
+{
+  "imports": {
+    "preact": "https://esm.sh/preact@10.15.1",
+    "preact/": "https://esm.sh/preact@10.15.1/"
+  }
+}
diff --git a/tests/specs/info/import_map/deno.lock b/tests/specs/info/import_map/deno.lock
new file mode 100644
index 000000000..cb5c6ca45
--- /dev/null
+++ b/tests/specs/info/import_map/deno.lock
@@ -0,0 +1,10 @@
+{
+  "version": "3",
+  "remote": {
+    "https://esm.sh/preact@10.15.1": "4bfd0b2c5a2d432e0c8cda295d6b7304152ae08c85f7d0a22f91289c97085b89",
+    "https://esm.sh/preact@10.15.1/debug": "4bfd0b2c5a2d432e0c8cda295d6b7304152ae08c85f7d0a22f91289c97085b89",
+    "https://esm.sh/stable/preact@10.15.1/denonext/debug.js": "e8e5e198bd48c93d484c91c4c78af1900bd81d9bfcfd543e8ac75216f5404c10",
+    "https://esm.sh/stable/preact@10.15.1/denonext/devtools.js": "f61430e179a84483f8ea8dc098d7d0d46b2f0546de4027518bfcef197cd665c9",
+    "https://esm.sh/stable/preact@10.15.1/denonext/preact.mjs": "30710ac1d5ff3711ae0c04eddbeb706f34f82d97489f61aaf09897bc75d2a628"
+  }
+}
diff --git a/tests/specs/info/import_map/main.tsx b/tests/specs/info/import_map/main.tsx
new file mode 100644
index 000000000..e38f14a58
--- /dev/null
+++ b/tests/specs/info/import_map/main.tsx
@@ -0,0 +1,2 @@
+import { render } from "preact";
+console.log(render);
diff --git a/tests/specs/info/import_map/with_import_map.out b/tests/specs/info/import_map/with_import_map.out
new file mode 100644
index 000000000..29dc17737
--- /dev/null
+++ b/tests/specs/info/import_map/with_import_map.out
@@ -0,0 +1,16 @@
+Download https://esm.sh/preact@10.15.1/debug
+Download https://esm.sh/stable/preact@10.15.1/denonext/preact.mjs
+Download https://esm.sh/stable/preact@10.15.1/denonext/devtools.js
+Download https://esm.sh/stable/preact@10.15.1/denonext/debug.js
+local: [WILDCARD]
+type: JavaScript
+dependencies: 3 unique
+size: [WILDCARD]
+
+https://esm.sh/preact@10.15.1/debug [WILDCARD]
+├── https://esm.sh/stable/preact@10.15.1/denonext/preact.mjs [WILDCARD]
+├─┬ https://esm.sh/stable/preact@10.15.1/denonext/devtools.js [WILDCARD]
+│ └── https://esm.sh/stable/preact@10.15.1/denonext/preact.mjs [WILDCARD]
+└─┬ https://esm.sh/stable/preact@10.15.1/denonext/debug.js [WILDCARD]
+  ├── https://esm.sh/stable/preact@10.15.1/denonext/preact.mjs [WILDCARD]
+  └── https://esm.sh/stable/preact@10.15.1/denonext/devtools.js [WILDCARD]