Add `-fplugin-trustworthy` to avoid marking modules as unsafe

All plugins used to be treated as unsafe and modules built with it will be unsafe as well. This is sometimes too strict and prevents some use cases. In this change, we enable plugin to return a Bool to tell us whether it is trustworthy. The default behavior is "no" and plugin author can explicitly change it to something else. The plugin user can also wrap a plugin with trustPlugin or distructPligin if the plugin doesn't work in a way they want.

By default, when a module is compiled with plugins, it will be marked as unsafe. With this flag passed, all plugins are treated as trustworthy and the safety inference will no longer be affected.

This fixes Trac #16260 (closed).