Implement wsConnect, wsMessage, wsSend, and wsClose hook kinds so plugins
can intercept WebSocket connections and frames. Refactor the hook matcher
to match paths independently of HTTP requests and add runHookTurnTimeout
so WebSocket hook turns that exceed the runtime timeout can fall back to
passing the message through without blocking the caller.
Update plugin permissions to separate admin-approved capabilities from
runtime settings. Add AllowSystemRPC, AllowRoutes, and AllowHooks to
control server.call, server.route, and server.hook respectively.
Registering RPC methods, reading own config, and accessing plugin-local
files remain always allowed, so plugins without dangerous permissions
can be enabled without approval.
Add tests covering server module enforcement and default-granted
capabilities.
Akizon77