Disallow loading project-local plugins by default

[zhiltsov-max]

As such plugins are just python code, they can be specifically crafted by an attacker to be run by a user on opening a project. The possible solution is disallowing loading of project plugins by default and provision of an API / env. var. for controlling this.