Managed settings gain prependPlugins/appendPlugins, admin-only plugin ordering

What

• Two new managed-settings keys, prependPlugins and appendPlugins, let an administrator force certain plugins to always load first or last; malformed values fall back to an empty list.
• Settings loaded from user-writable files (not managed/administrator settings) can no longer set secDefault, prependPlugins, or appendPlugins, and can no longer use enabledPlugins to enable a plugin or name a built-in plugin — these are stripped with a warning as administrator-only.
• If a plugin is listed in both prependPlugins and appendPlugins, it's resolved by prepending it, with a warning; a warning is also shown when a user setting is overridden ("shadowed") by managed policy.
• Each plugin's hooks module is now resolved to a "tier" (prepend, builtin, user, or append) based on these managed lists, and calls like next.to("<tier>") inside a plugin's hooks are validated against that tier, throwing if the plugin isn't managed or the named tier isn't actually next in the chain.

Why This gives organizations a way to guarantee that certain plugins, such as security or compliance hooks, always run first or last, and prevents individual users from overriding that ordering or granting themselves extra plugin access through local settings files.