Inspect plugin packages

[Srokap]

That would cover:

• giving preview of package contents (files tree, zip packages handling example here: https://github.com/Srokap/srokap_plugin_installer)
• extracting manifests (could display it's data and even compare with declared license/compatibility)
  • automatic extraction of screenshots
• code quality analysis
  • coding standards
  • detect deprecated functions usage - https://github.com/Srokap/code_review
  • existence of comments?
  • some nice tool for potential problems finder?

See https://github.com/Elgg/community_plugins/issues/34

All of it would serve only informative purposes. I wouldn't want to automatically block plugins, trigger an alert at most.

Some existing tools ideas:

• http://www.sonarsource.com/
• http://sourceforge.net/projects/rips-scanner/
• https://www.owasp.org/index.php/Source_Code_Analysis_Tools

[jdalsem]

Regarding the analysis of manifest files https://github.com/Elgg/Elgg/issues/5895