Investigate different extension update mechanisms

[isidorn]

Right now all extensions auto-update.

1. We need to surface extensions.autoUpdate setting to be enterprise controlled
2. We need to think if there is a smarter auto-update mechanism. For example - should we update extensions with some delay, or updating it in batches.

[isidorn]

Why do we actually have autoUpdate for extensions turned on by default.
Users can not easily review the changes.

[Tyriar]

Related to this: even if auto update is on, I'd love it if an extension that went from codeless (eg. a theme) to having code would require explicit updating.

[isidorn]

We could remember the extension metadata on install and if that changes, then update has to be manually approved by user.

This involves making sure that user on install sees the extension metadata.

[sandy081]

Related to this: even if auto update is on, I'd love it if an extension that went from codeless (eg. a theme) to having code would require explicit updating.

This is tracked here - #222024

[isidorn]

Some good discussions in the standup.

1. Intelli-J shows a dialog when users want to install a 3rd party extension ("proceed with caution"). Do we need something similar?
2. Do we want a "reassuring UI" for extensions that do not have any Code. If we do this we must make sure that all static contributions are safe, and that default settings overrides are secure (right now Typescript settings for pointing to a TS executable can be overriden by a 3rd party extension setting default)
3. Or do we just want a smart auto-update. For example - we auto update all extensions from authors that users trusts, and extensions that have no code. This would require nice UI for users to specify that they trust an extension author.
4. When a user decides if they should update an extension we should have a link to the extension repository. So user actually has an action to do when deciding if they want to update. This nicely marries the repository provenience work that MP might pick up in the future
5. If user decides to stay on an extension version. We should no longer render a Badge in the Extensions view. The badge distracts the user, while the user already decided they do not want to update
6. If I do "Update All" the "pinned" extensions should not be updated. User already made a decision to stick to a particular version, update all should not overwrite this

fyi @hediet @aeschli @skofman1 @ulugbekna

[isidorn]

Related discussion for extension install experience #215527