feat: add `--allow-import` flag (#25469)

This replaces `--allow-net` for import permissions and makes the
security sandbox stricter by also checking permissions for statically
analyzable imports.

By default, this has a value of
`--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`,
but that can be overridden by providing a different set of hosts.

Additionally, when no value is provided, import permissions are inferred
from the CLI arguments so the following works because
`fresh.deno.dev:443` will be added to the list of allowed imports:

```ts
deno run -A -r https://fresh.deno.dev
```

---------

Co-authored-by: David Sherret <dsherret@gmail.com>

3 files changed, 64 insertions, 0 deletions

diff --git a/tests/specs/npm/cjs_sub_path/__test__.jsonc b/tests/specs/npm/cjs_sub_path/__test__.jsonc
new file mode 100644
index 000000000..dbec76a13
--- /dev/null
+++ b/tests/specs/npm/cjs_sub_path/__test__.jsonc
@@ -0,0 +1,8 @@
+{
+  "args": "run --allow-read cjs_sub_path/main.js",
+  "output": "cjs_sub_path/main.out",
+  "envs": {
+    "NO_COLOR": "1",
+    "NPM_CONFIG_REGISTRY": "http://localhost:4260/"
+  }
+}
diff --git a/tests/specs/npm/cjs_sub_path/cjs_sub_path/main.js b/tests/specs/npm/cjs_sub_path/cjs_sub_path/main.js
new file mode 100644
index 000000000..b71360959
--- /dev/null
+++ b/tests/specs/npm/cjs_sub_path/cjs_sub_path/main.js
@@ -0,0 +1,21 @@
+// this package will require a subpath like "ajv/dist/compile/codegen"
+// and also get the parent directory index.js file using require("..")
+import Ajv from "npm:ajv@~8.11";
+import addFormats from "npm:ajv-formats@2.1.1";
+import { expect } from "npm:chai@4.3";
+
+const ajv = new Ajv();
+addFormats(ajv);
+
+const schema = {
+  type: "string",
+  format: "date",
+  formatMinimum: "2016-02-06",
+  formatExclusiveMaximum: "2016-12-27",
+};
+const validate = ajv.compile(schema);
+
+expect(validate("2016-02-06")).to.be.true;
+expect(validate("2016-02-05")).to.be.false;
+
+console.log("Fini");
diff --git a/tests/specs/npm/cjs_sub_path/cjs_sub_path/main.out b/tests/specs/npm/cjs_sub_path/cjs_sub_path/main.out
new file mode 100644
index 000000000..868733775
--- /dev/null
+++ b/tests/specs/npm/cjs_sub_path/cjs_sub_path/main.out
@@ -0,0 +1,35 @@
+[UNORDERED_START]
+Download http://localhost:4260/ajv
+Download http://localhost:4260/ajv-formats
+Download http://localhost:4260/chai
+Download http://localhost:4260/fast-deep-equal
+Download http://localhost:4260/json-schema-traverse
+Download http://localhost:4260/require-from-string
+Download http://localhost:4260/uri-js
+Download http://localhost:4260/assertion-error
+Download http://localhost:4260/check-error
+Download http://localhost:4260/deep-eql
+Download http://localhost:4260/get-func-name
+Download http://localhost:4260/loupe
+Download http://localhost:4260/pathval
+Download http://localhost:4260/type-detect
+Download http://localhost:4260/punycode
+[UNORDERED_END]
+[UNORDERED_START]
+Download http://localhost:4260/ajv/ajv-8.11.0.tgz
+Download http://localhost:4260/ajv-formats/ajv-formats-2.1.1.tgz
+Download http://localhost:4260/assertion-error/assertion-error-1.1.0.tgz
+Download http://localhost:4260/chai/chai-4.3.6.tgz
+Download http://localhost:4260/check-error/check-error-1.0.2.tgz
+Download http://localhost:4260/deep-eql/deep-eql-3.0.1.tgz
+Download http://localhost:4260/fast-deep-equal/fast-deep-equal-3.1.3.tgz
+Download http://localhost:4260/get-func-name/get-func-name-2.0.0.tgz
+Download http://localhost:4260/json-schema-traverse/json-schema-traverse-1.0.0.tgz
+Download http://localhost:4260/loupe/loupe-2.3.4.tgz
+Download http://localhost:4260/pathval/pathval-1.1.1.tgz
+Download http://localhost:4260/punycode/punycode-2.1.1.tgz
+Download http://localhost:4260/require-from-string/require-from-string-2.0.2.tgz
+Download http://localhost:4260/type-detect/type-detect-4.0.8.tgz
+Download http://localhost:4260/uri-js/uri-js-4.4.1.tgz
+[UNORDERED_END]
+Fini