Proposal: trust model around custom plugin indexes

Related: #483

Currently every plugin installed/upgraded from krew-index comes with a security warning:

WARNING: You installed plugin "ns" from the krew-index plugin repository.
   These plugins are not audited for security by the Krew maintainers.
   Run them at your own risk.

The reason we added this is because users must understand that they are downloading potentially unvetted binaries.

With the fact that multiple indexes are now happening, this opens several possibilities to rethink this experience, given:

• adding a plugin index is an explicit operation for the user (or IT admin)
• default index (krew-index) becomes just another index that user (or IT admin) can remove

Proposal 1

• Trust all "custom" indexes implicitly.

  • do not print security warning during install
  • (maybe) add a warning while the index is added via "krew index add" command

• default index (i.e. krew-index) would still print installation warnings

  1. krew-index is still what 90% of our users will be using
  2. krew-index is added automatically (though, we haven't discussed how that looks like in a multi-index mode, but it's likely we don't want explicit user interaction as that'd break many user journeys)

Notes:

• does a custom treatment of "default" index
• what if "default" isn't actually pointing to krew-index repository?

Proposal 2

Trust "all" indexes explicitly on the first use.

• First time someone tries to install a plugin through "krew install", we present an interactive (Y/n?) consent with the security message.
• The "trust" action is stored on disk (likely through a file indicator)
• Successive "krew install" commands using that index don't cause security messages.

Notes:

• Most first-time users of krew will see an interactive warning, once (as they're installing via krew-index)
  • Does an "interactive prompt" actually achieve something –or are we just covering our back with this warning? If the user meant to run a command, they are very likely to say "no" –but they should be aware of the risks.
• Is trusting an index once a good model? e.g. users might forget the risks several months after acknowledging the centralized krew-index
• How does it work non-interactively (e.g. krew install < myplugins.txt)? (Likely we'd need to fail and add a --trust/--quiet flag to install which I'm not super eager about.)
• Introduces new files and logic to store this "trust".
  • The logic must be able to handle when index is removed and re-added (potentially with a new git remote)
• How does the user revoke "trust" action? (I don't want to add cmds or flags about trust.)
• No special treatment of krew-index (existing users also go through this)

/kind proposal /area multi-index /priority important-soon /cc @corneliusweig /cc @chriskim06