Notify users when installing an extension from a publisher for the first time

[isidorn]

To start I propose we do a similar solution like Intelli-J. On extension install we show a dialog with the following text

"EXTENSION NAME is coming from EXTENSION_AUTHOR. Installing extensions is similar to installing and running applications. Extensions get the same permissions as PRODUCT_NAME itself. Only proceed if you trust EXTENSION_AUTHOR."

• Always trust extensions from EXTENSION_AUTHOR

"Cancel" "Learn More" "Install"

Always trust extensions from EXTENSION_AUTHOR would go to machine storage. By default Microsoft and GitHub would be trusted - since the user already placed their trust in VS Code.

Learn More would take users to doc (@isidorn to author - tracked microsoft/vscode-docs#7874)

We also need command to manage the preserved state.

I think this will be a better fit than workspace trust, since we actually show the dialog at the right moment (when user is installing an extension). Unlike on startup with workspace trust.

Step 2 (out of scope of this issue) is to show additional information in this dialog. For example:

• Name / publisher name (verified)
• Ratings
• Repository (with some metadata if it actually belongs to publisher)
• Install Count
• Last published

[isidorn]

Putting to July, just because I do not want already to create the August milestone. As soon as it gets created will move this issue to that milestone.

[isidorn]

@ulugbekna made a good point that intelli-j shows a dialog on install for 3rd parties "proceed with caution". Here's how it looks

Full text used

"The following plugins aren't coming from JetBrains:   

AWS Toolkit (Amazon Web Services)

Installing plugins is similar to installing and running applications. Plugins get the same permissions as the IDE process itself. Only proceed if you trust the plugins.

You are also advised to check the plugin vendor’s documentation for details on how the vendor can process your personal data. JetBrains is not responsible for any behavior of any third-party plugins and their vendors, including processing of your personal data."

fyi @sandy081 @alexdima @joaomoreno