Support for external plugin sources #2

Claude and Copilot support external plugin sources. We should consider doing the same here.

There are some open security questions around this, so having recommendation for clients would be good. Currently in VS Code I am very conservative and prompt the user before doing any npm or pip install due to the risk of side effects.