Plugin assets, external scripts and CSP overrides (#4260)

* Add assets for plugins
* Move plugin javascript and css into separate endpoints
* Allow loading external scripts
* Add csp overrides
* Only include enabled plugins
* Move URLMap to utils
* Use URLMap for assets
* Add documentation

graphql/documents/queries/plugins.graphql

@@ -24,6 +24,11 @@ query Plugins {
       description
       type
     }
+
+    paths {
+      css
+      javascript
+    }
   }
 }