fix: block unvetted plugin setup execution

[Sourav001254]

This PR adds a focused security hardening step for plugin loading related to #7046.

Uploaded or otherwise unvetted plugins could still execute setup code through dynamically injected Blob scripts after a confirmation prompt. This change prevents unvetted plugin setup sections from being executed directly in the main application context.

Changes:-

1. Added a shared isVettedPluginSource() helper for plugin source trust checks.
2. Blocked unvetted BLOCKPLUGINS, GLOBALS, and ONLOAD setup code from Blob script injection.
3. Kept vetted built-in/local plugins on the existing direct execution path for compatibility and performance.
4. Added regression tests to verify uploaded plugin setup code does not create Blob scripts or inject script tags.

• Security Fix
• Bug Fix

[github-actions]

✅ All Jest tests passed! This PR is ready to merge.

Coverage: Statements: 44.92% | Branches: 36.46% | Functions: 49.99% | Lines: 45.35%

[karthik-dev56]

@Sourav001254 add validation check its bug right so - [x] Bug Fix : issue number

[Sourav001254]

@walterbender @sum2it @omsuneri kindly review this PR

[github-actions]

This PR has merge conflicts with master.

Please rebase your branch:

# Add upstream remote (one-time setup)
git remote add upstream https://github.com/sugarlabs/musicblocks.git

# Fetch latest master and rebase
git fetch upstream
git rebase upstream/master

# Resolve any conflicts, then:
git push --force-with-lease origin YOUR_BRANCH

Tip: Enable "Allow edits from maintainers" on this PR so we can auto-rebase for you next time. This only grants access to your PR branch. Your fork's other branches are not affected.

[github-actions]

This PR has merge conflicts with master.

Please rebase your branch:

# Add upstream remote (one-time setup)
git remote add upstream https://github.com/sugarlabs/musicblocks.git

# Fetch latest master and rebase
git fetch upstream
git rebase upstream/master

# Resolve any conflicts, then:
git push --force-with-lease origin YOUR_BRANCH

Tip: Enable "Allow edits from maintainers" on this PR so we can auto-rebase for you next time. This only grants access to your PR branch. Your fork's other branches are not affected.

[rish106-hub]

Heads up — I opened #NNNN which addresses the same gap on current master. Since this branch was cut before the isVettedPlugin refactor landed, #NNNN reuses that existing predicate instead of adding a parallel helper, and applies cleanly without conflicts. Flagging so maintainers can pick whichever fits.

[rish106-hub]

Heads up — I opened #7762 which addresses the same gap on current master. Since this branch predates the isVettedPlugin refactor, #7762 reuses that existing predicate instead of adding a parallel helper, and applies without conflicts. Flagging so maintainers can pick whichever fits.