QA & security checks and tagging system for plugins

[Xpirix]

We should do this in multiple phases, including two QEPs to advertise and gather feedback for this change.

Cc @timlinux