ext_repo_download setting

[MegaphoneJon]

Overview

https://lab.civicrm.org/dev/core/-/work_items/6526 describes an issue I recently encountered - I don't want end users to install extensions, but I want my monitoring to pick up that extensions need updating. @herbdool implemented a more limited fix, but for my use case, implementing the full fix seemed more feasible than managing the file permissions.

Before

Both allowing extension downloads and checking for available updates are controlled by a single setting.

After

You can check for available updates without allowing downloads.

Comments

I considered consolidating a bit more but I think this is the best approach without misusing CRM_Extension_Browser or a more significant rewrite.

[civibot]

🤖 Thank you for contributing to CiviCRM! ❤️ We will need to test and review this PR. 👷

Introduction for new contributors...

• If this is your first PR, an admin will greenlight automated testing with the command ok to test or add to whitelist.
• A series of tests will automatically run. You can see the results at the bottom of this page (if there are any problems, it will include a link to see what went wrong).
• A demo site will be built where anyone can try out a version of CiviCRM that includes your changes.
• If this process needs to be repeated, an admin will issue the command test this please to rerun tests and build a new demo site.
• Before this PR can be merged, it needs to be reviewed. Please keep in mind that reviewers are volunteers, and their response time can vary from a few hours to a few weeks depending on their availability and their knowledge of this particular part of CiviCRM.
• A great way to speed up this process is to "trade reviews" with someone - find an open PR that you feel able to review, and leave a comment like "I'm reviewing this now, could you please review mine?" (include a link to yours). You don't have to wait for a response to get started (and you don't have to stop at one!) the more you review, the faster this process goes for everyone 😄
• To ensure that you are credited properly in the final release notes, please add yourself to contributor-key.yml
• For more information about contributing, see CONTRIBUTING.md.

PR commands & links...

• /rebase <branch-name> will rebase your branch and change the base of the PR.
• /squash will combine all commits (keeping only the first commit messsage).
• /port <branch-name> will create a copy of this PR against a different branch.
• /lintroll will automatically fix linting errors, amending commits as needed.
• retest this please will rerun the tests and rebuild the demo site.
• 📖 Review standards
• 🗒️ Review template (brief or verbose)

➡️ Online demo of this PR 🔗

[mlutfy]

Looks good to me. Thanks @MegaphoneJon !

However, it is a bit outside my comfort area, so I will let another person merge.

[ufundo]

I think this functionality makes a lot of sense @MegaphoneJon

But it feels security conscious - and I think it would be good to add is_constant flag to the setting meta so that it is only settable with code access?