feat: add `--allow-import` flag (#25469)

This replaces `--allow-net` for import permissions and makes the
security sandbox stricter by also checking permissions for statically
analyzable imports.

By default, this has a value of
`--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`,
but that can be overridden by providing a different set of hosts.

Additionally, when no value is provided, import permissions are inferred
from the CLI arguments so the following works because
`fresh.deno.dev:443` will be added to the list of allowed imports:

```ts
deno run -A -r https://fresh.deno.dev
```

---------

Co-authored-by: David Sherret <dsherret@gmail.com>

7 files changed, 47 insertions, 0 deletions

diff --git a/tests/specs/info/recursive_modules/__test__.jsonc b/tests/specs/info/recursive_modules/__test__.jsonc
new file mode 100644
index 000000000..c4313a2fb
--- /dev/null
+++ b/tests/specs/info/recursive_modules/__test__.jsonc
@@ -0,0 +1,5 @@
+{
+  "args": "info --quiet info_recursive_imports_test.ts",
+  "output": "info_recursive_imports_test.out",
+  "exitCode": 0
+}
diff --git a/tests/specs/info/recursive_modules/info_recursive_imports_test.out b/tests/specs/info/recursive_modules/info_recursive_imports_test.out
new file mode 100644
index 000000000..3340f3859
--- /dev/null
+++ b/tests/specs/info/recursive_modules/info_recursive_imports_test.out
@@ -0,0 +1,13 @@
+local: [WILDCARD]info_recursive_imports_test.ts
+type: TypeScript
+dependencies: 4 unique
+size: [WILDCARD]
+
+file://[WILDCARD]/info_recursive_imports_test.ts ([WILDCARD])
+└─┬ file://[WILDCARD]/recursive_imports/A.ts ([WILDCARD])
+  ├─┬ file://[WILDCARD]/recursive_imports/B.ts ([WILDCARD])
+  │ ├─┬ file://[WILDCARD]/recursive_imports/C.ts ([WILDCARD])
+  │ │ ├── file://[WILDCARD]/recursive_imports/A.ts *
+  │ │ └── file://[WILDCARD]/recursive_imports/common.ts ([WILDCARD])
+  │ └── file://[WILDCARD]/recursive_imports/common.ts *
+  └── file://[WILDCARD]/recursive_imports/common.ts *
diff --git a/tests/specs/info/recursive_modules/info_recursive_imports_test.ts b/tests/specs/info/recursive_modules/info_recursive_imports_test.ts
new file mode 100644
index 000000000..c9ba44755
--- /dev/null
+++ b/tests/specs/info/recursive_modules/info_recursive_imports_test.ts
@@ -0,0 +1,5 @@
+import { A } from "./recursive_imports/A.ts";
+
+export function test() {
+  A();
+}
diff --git a/tests/specs/info/recursive_modules/recursive_imports/A.ts b/tests/specs/info/recursive_modules/recursive_imports/A.ts
new file mode 100644
index 000000000..43ecdbe5e
--- /dev/null
+++ b/tests/specs/info/recursive_modules/recursive_imports/A.ts
@@ -0,0 +1,7 @@
+import { B } from "./B.ts";
+import { thing } from "./common.ts";
+
+export function A() {
+  thing();
+  B();
+}
diff --git a/tests/specs/info/recursive_modules/recursive_imports/B.ts b/tests/specs/info/recursive_modules/recursive_imports/B.ts
new file mode 100644
index 000000000..9fff0fdc9
--- /dev/null
+++ b/tests/specs/info/recursive_modules/recursive_imports/B.ts
@@ -0,0 +1,7 @@
+import { C } from "./C.ts";
+import { thing } from "./common.ts";
+
+export function B() {
+  thing();
+  C();
+}
diff --git a/tests/specs/info/recursive_modules/recursive_imports/C.ts b/tests/specs/info/recursive_modules/recursive_imports/C.ts
new file mode 100644
index 000000000..e47e77b41
--- /dev/null
+++ b/tests/specs/info/recursive_modules/recursive_imports/C.ts
@@ -0,0 +1,8 @@
+import { A } from "./A.ts";
+import { thing } from "./common.ts";
+
+export function C() {
+  if (A != null) {
+    thing();
+  }
+}
diff --git a/tests/specs/info/recursive_modules/recursive_imports/common.ts b/tests/specs/info/recursive_modules/recursive_imports/common.ts
new file mode 100644
index 000000000..2b16a7bf1
--- /dev/null
+++ b/tests/specs/info/recursive_modules/recursive_imports/common.ts
@@ -0,0 +1,2 @@
+export function thing() {
+}