Implement Endo privileged plugin API

[kriskowal]

Summary: the next step in the evolution of the Endo daemon’s bootstrap object is to expose an API on the private facet that can install Endo Application Facet plugins. An Endo Application Facet plugins will run with the full power of the user inside the Endo process or Endo worker processes.

Endo Applications will fully describe the shape of the Endo Application Facet they are expecting, which will be communicated to the end-user for approval when they run an Endo Application. So, Endo Plugins will also need to describe the capabilities they offer in a similar manifest, since that is the prose that will be presented to the user.

This makes white-labelling Endo Browser really straightforward. Every variant just has different branding and may come with some plugins. The Agoric variant of the Endo Browser, for example, would come with an Ag Solo plugin. This also means that every white-label of an Endo Browser could converge by installing the union of plugins shared by multiple white-labeled Endo Browsers.

[Tartuffo]

This is actually in progress, but on the back burner.

[kriskowal]

This has landed in the endo feature branch. This can be seen with endo make --UNSAFE plugin.js --name plugin --powers ENDO|HOST|guest-name