Add external path and type whitelist to ResourceLoader

[fire]

For review.

[fire]

if (using_whitelist && !external_path_whitelist.has(path)) {
   WARN_PRINT(vformat("Blocked internal resource path not in whitelist: %s.", path));

Lyuma is skeptical about the validation of internal sub-resource references. Do you know when this code was added?

-               external_resources.write[i].load_token = ResourceLoader::_load_start(path, external_resources[i].type, use_sub_threads ? ResourceLoader::LOAD_THREAD_DISTRIBUTE : ResourceLoader::LOAD_THREAD_FROM_CURRENT, ResourceFormatLoader::CACHE_MODE_REUSE, false, false, Dictionary(), Dictionary());
+               external_resources.write[i].load_token = ResourceLoader::_load_start(path, external_resources[i].type, use_sub_threads ? ResourceLoader::LOAD_THREAD_DISTRIBUTE : ResourceLoader::LOAD_THREAD_FROM_CURRENT, cache_mode_for_external, true, using_whitelist, external_path_whitelist, type_whitelist);

If Lyuma recalls, this was the change that broke it. Basically, the original idea was that external resources (which are whitelisted) would themselves be exempted from using whitelisted loading, under the assumption that these external resources are trusted but by passing the using_whitelist into the external resource load, it can cause an otherwise simple script to fail loading due to depending on something not in the whitelist.

From looking at the diff, the text resources were previously not using the whitelist?

[lyuma]

Same comments left in discord

[fire]

Test failure.

./tests/scene/test_resource_loader.h:151:
TEST CASE:  [SceneTree][ResourceLoader] Load Binary Resource Whitelisted - No allowed paths in the whitelist

./tests/scene/test_resource_loader.h:159: ERROR: CHECK_FALSE( resource.is_valid() ) is NOT correct!
  values: CHECK_FALSE( true )

TEST_CASE("[SceneTree][ResourceLoader] Load Binary Resource Whitelisted - No allowed paths in the whitelist") {
	init("load_resource_whitelisted_malicious_path", "res://");
	Dictionary ext_whitelist;
	Dictionary type_whitelist;
	type_whitelist["GradientTexture2D"] = true;
	type_whitelist["Gradient"] = true;
	Ref<Texture2D> resource = ResourceLoader::load_whitelisted(
			"res://trojan_resource.res", ext_whitelist, type_whitelist, "Texture2D");
	CHECK_FALSE(resource.is_valid());
}