Restrict plugins to an existing allowlist

Adds a singleton to do validation that can be disabled via a
BUILD_BROKEN_PLUGIN_VALIDATION flag.

Validation process:
For all go modules that are a plugin for soong_build:
* if path is in build/soong, allow
* if path is in vendor, outside of google paths, allow
* if path is in hardware, outside of google paths, allow
* if name is in allowlist of current plugins, allow

We extend the plugin the list for internal modules via
vendor/google/build/soong/internal_plugins.json

Ignore-AOSP-First: Requires an internal only change to not break when submitted
Test: CI
Change-Id: I264a89b3636043330711d6c996c0360b61f51d92