Restrict plugins to an existing allowlist

Adds a singleton to do validation that can be disabled via a
BUILD_BROKEN_PLUGIN_VALIDATION flag.

Validation process:
For all go modules that are a plugin for soong_build:
* if path is in build/soong, allow
* if path is in vendor, outside of google paths, allow
* if path is in hardware, outside of google paths, allow
* if name is in allowlist of current plugins, allow

We extend the plugin the list for internal modules via
vendor/google/build/soong/internal_plugins.json

Ignore-AOSP-First: Requires an internal only change to not break when submitted
Test: CI
Change-Id: I264a89b3636043330711d6c996c0360b61f51d92

android/variable.go

@@ -437,6 +437,7 @@ type productVariables struct {
 
 	ShippingApiLevel *string `json:",omitempty"`
 
+	BuildBrokenPluginValidation        []string `json:",omitempty"`
 	BuildBrokenClangAsFlags            bool     `json:",omitempty"`
 	BuildBrokenClangCFlags             bool     `json:",omitempty"`
 	BuildBrokenClangProperty           bool     `json:",omitempty"`