Fix /api/plugins leaking filesystem paths

Replace PluginWebApi's requirePath member with npmPackage which is only
populated if the package is not marked as private and the requirePath
matches the name. This prevents the public /api/plugins endpoint from
leaking filesystem paths into the controller.

packages/controller/src/Controller.ts

@@ -113,7 +113,7 @@ export default class Controller {
 
 	constructor(
 		clusterLogger: winston.Logger,
-		pluginInfos: any[],
+		pluginInfos: lib.PluginNodeEnvInfo[],
 		configPath: string,
 		config: lib.ControllerConfig,