Security isolation support: Plugin js bundle builder

[nyurik]

To support plugin isolation in an iframe, plugins need a way to get a js code bundle that's independent of the main Kibana js bundle. For example, to support #2873, Vega vis would need a separate bundle that includes just the vega library (see prototype #15014 (comment)). To make this more generic, we could establish this pattern:

/plugin
  /vega
    /public         - all the regular plugin code (not sandboxed)
    /vega-sandbox   - any dir that ends in "-sandbox" gets a separate js bundle
      package.json
      index.html
      index.js

The plugin would create an <iframe sandbox src=index.html>, and the index.js would be the starting point for the bundle building.

Ideally, packag.json should be separate from the the main one, and have its own set of dependencies, but this might not be feasible with the current yarn implementation, forcing all deps to be listed in the main package.json.

[stacey-gammon]

Reassigning to to @elastic/kibana-platform since they cover the plugin infrastructure. Maybe even @elastic/kibana-security ...