Allow custom JSON files

[wlandau]

Packages like paws use subdirectories. These cases are extremely rare, so as we discussed in r-multiverse/help#1, this PR allows custom JSON entries for the little text files contributed to https://github.com/r-releases/r-releases. These are all detected as JSON, flagged for manual review, and merged into the universe.

@shikokuchuo, would you please review?

[shikokuchuo]

If I'm reading this correctly it allows any additional JSON fields, but I think we should specifically just check for 'subdir'. This will prevent simple exploits that try to add arbitrary data to our files.

[wlandau]

If I'm reading this correctly it allows any additional JSON fields, but I think we should specifically just check for 'subdir'. This will prevent simple exploits that try to add arbitrary data to our files.

build_universe() does allow custom JSON, but assert_package() flags all custom JSON for manual review: https://github.com/wlandau/r.releases.utils/blob/e3c024ffb6593731b2f2308f6bb248b52b25d60e/R/assert_package.R#L15-L24. Does the obligatory manual review address the exploit issue? I'm a little concerned that just focusing on subdir will prevent us from allowing custom JSON for other reasons we can't foresee yet.

[shikokuchuo]

I would prefer to take the opposite approach as currently we only know about 'subdir'. It seems risky to accommodate an 'unkown unkown' as the manual review can still be overridden. Does that make sense?

[wlandau]

Yeah, if the human review is careless, we would want another guardrail to prevent something truly calamitous. Added in 00cb225.

[shikokuchuo]

Looks great! Just a couple things.