/plugin validate inspects hooks modules instead of a declared capabilities list

Validating a plugin's hooks.json now loads each JavaScript hooks module it names, refuses any path that points outside the plugin directory, and reads the module to report which events it hooks and which plugin APIs it calls. A capabilities field in the file is now reported as ignored and safe to delete.