Fix /api/plugins leaking filesystem paths

Replace PluginWebApi's requirePath member with npmPackage which is only
populated if the package is not marked as private and the requirePath
matches the name. This prevents the public /api/plugins endpoint from
leaking filesystem paths into the controller.

packages/controller/src/Controller.ts

@@ -113,7 +113,7 @@ export default class Controller {
 
 	constructor(
 		clusterLogger: winston.Logger,
-		pluginInfos: any[],
+		pluginInfos: lib.PluginNodeEnvInfo[],
 		configPath: string,
 		config: lib.ControllerConfig,
 

packages/controller/src/routes.ts

@@ -95,7 +95,7 @@ async function getMetrics(req: Request, res: Response, next: any) {
 
 function getPlugins(req: Request, res: Response) {
 	let plugins: lib.PluginWebApi[] = [];
-	for (let pluginInfo of req.app.locals.controller.pluginInfos) {
+	for (let pluginInfo of (req.app.locals.controller as Controller).pluginInfos) {
 		let name = pluginInfo.name;
 		let loaded = req.app.locals.controller.plugins.has(name);
 		let enabled = loaded && req.app.locals.controller.config.group(pluginInfo.name).get("load_plugin");
@@ -115,7 +115,7 @@ function getPlugins(req: Request, res: Response) {
 		if (web.main === "remoteEntry.js") {
 			web.error = "Incompatible old remoteEntry.js entrypoint.";
 		}
-		plugins.push({ name, version: pluginInfo.version, enabled, loaded, web, requirePath: pluginInfo.requirePath });
+		plugins.push({ name, version: pluginInfo.version, enabled, loaded, web, npmPackage: pluginInfo.npmPackage });
 	}
 	res.send(plugins);
 }