Restrict third-party shell plugin capabilities

Reported-by: Roger Piñol <rogerpicar@gmail.com>

test/shell.d/fixtures/plugin-auth-boundary/AuthStoreReader.qml

@@ -0,0 +1,8 @@
+import QtQuick
+import "services/AuthServiceStore.js" as AuthServiceStore
+
+QtObject {
+  function has(id) {
+    return AuthServiceStore.has(id)
+  }
+}