feat: add `--allow-import` flag (#25469)

This replaces `--allow-net` for import permissions and makes the
security sandbox stricter by also checking permissions for statically
analyzable imports.

By default, this has a value of
`--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`,
but that can be overridden by providing a different set of hosts.

Additionally, when no value is provided, import permissions are inferred
from the CLI arguments so the following works because
`fresh.deno.dev:443` will be added to the list of allowed imports:

```ts
deno run -A -r https://fresh.deno.dev
```

---------

Co-authored-by: David Sherret <dsherret@gmail.com>

1 files changed, 57 insertions, 0 deletions

diff --git a/tests/specs/npm/info_cli_chalk_json/info/chalk_json.out b/tests/specs/npm/info_cli_chalk_json/info/chalk_json.out
new file mode 100644
index 000000000..d54155270
--- /dev/null
+++ b/tests/specs/npm/info_cli_chalk_json/info/chalk_json.out
@@ -0,0 +1,57 @@
+{
+  "roots": [
+    "npm:chalk@4"
+  ],
+  "modules": [
+    {
+      "kind": "npm",
+      "specifier": "npm:/chalk@4.1.2",
+      "npmPackage": "chalk@4.1.2"
+    }
+  ],
+  "redirects": {
+    "npm:chalk@4": "npm:/chalk@4.1.2"
+  },
+  "version": 1,
+  "npmPackages": {
+    "ansi-styles@4.3.0": {
+      "name": "ansi-styles",
+      "version": "4.3.0",
+      "dependencies": [
+        "color-convert@2.0.1"
+      ]
+    },
+    "chalk@4.1.2": {
+      "name": "chalk",
+      "version": "4.1.2",
+      "dependencies": [
+        "ansi-styles@4.3.0",
+        "supports-color@7.2.0"
+      ]
+    },
+    "color-convert@2.0.1": {
+      "name": "color-convert",
+      "version": "2.0.1",
+      "dependencies": [
+        "color-name@1.1.4"
+      ]
+    },
+    "color-name@1.1.4": {
+      "name": "color-name",
+      "version": "1.1.4",
+      "dependencies": []
+    },
+    "has-flag@4.0.0": {
+      "name": "has-flag",
+      "version": "4.0.0",
+      "dependencies": []
+    },
+    "supports-color@7.2.0": {
+      "name": "supports-color",
+      "version": "7.2.0",
+      "dependencies": [
+        "has-flag@4.0.0"
+      ]
+    }
+  }
+}