Move resources to asset bundle

[vanjac]

Include any resources that are not core to the app, and especially any that can't be made open-source, or require long import/compilation steps.

Including:

• Materials (except sky, invisible, ...) + textures/shaders
• Skyboxes
• Built-in sounds
• Meshes (#378)

Asset bundle should include a manifest.

Eventually these should be downloadable / installable.

[vanjac]

shadervariants https://forum.unity.com/threads/asset-bundles-and-shaders.806331/

[vanjac]

Asset types: https://docs.unity3d.com/Manual/BuiltInImporters.html

Security risks: https://blog.includesecurity.com/2022/09/hacking-unity-games-with-malicious-gameobjects-part-2/ https://web.archive.org/web/20231029015747/https://blog.unity.com/engine-platform/upm-dependency-confusion-assetbundle-security-in-the-editor

Safe to load(?):

• Materials
• Textures
• Meshes
• Audio
• Shaders
• TextAssets
• ...

NOT safe to load (without sanitizing):

• Prefabs (GameObjects)
  • Must only allow built-in Unity components (no MonoBehaviours)
  • Must block all Unity Events
• Scenes
• Animations
  • Must block Animation Events

[vanjac]

TODO:

• [x] Load footstep sounds from AssetBundle
• [x] Allow building only platform-specific AssetBundles
• [x] Allow other file extensions for models etc.