Git email patch review addon for Thunderbird

Hey, thanks!

I think it should be safe, but I'll dive into the security of it and mitigations I've put in place.

The risky part of the add-on is the part runs "privileged", and lives in extension/api/patchHost. Privileged in Thunderbird's context means that it has access to the computer, which the plugin needs to run git commands on the repo. The privileged part is roughly ~500 lines of code, and I've looked over it to make sure it's sane (but since I didn't write it, it is easier to overlook aspects).

Another thing to be aware of is that the add-on helps the user by verifying beforehand if a patch can be applied or not. To do so it creates a git worktree, which it applies the patch to. An attacker could potentially abuse hooks that trigger when patches are applied, and so what I've done is disable hooks for the git operations that the add-on performs automatically.

The rest of the plugin adheres to the permissions declared in manifest.json, and thus has no network access nor the ability to move or delete messages. The most notable permissions it has are the ability to read messages (needed to render the patch) and send messages (needed to send feedback). If you're worried the plugin will send gibberish, you can use the "Preview in compose", where you'll be able to confirm what the sent email will look like.

Hope this helps!