Refactor ckeditor plugin dependencies

Problem/Motivation

We recently had a few security updates to CKEditor plugins that Sector requires. These three plugins are fakeobjects, templates, and link. As there are repositories blocks for each of these, every single project that uses Sector has to have these 3 repositories blocks duplicated. The version in these have to match the versions in Sector. When we update the versions in Sector, projects based on Sector won't update to new version of Sector until the user manually updates the repositories blocks.

There is no immediate error show to the user unless they put a hard dependency on a higher version of Sector in their project, and this also requires more detailed release notes every time we are forced to make a change. There is a huge amount of overhead and headache associated with keeping these plugins up to date.

The contrib modules that require these are: anchor_link → (ckeditor/fakeobjects and ckeditor/link) and wysiwyg_templates → (ckeditor/templates).

Proposed resolution

I want to take some inspiration from the webform module. They do two things:

1. Load CKEditor plugins from a CDN so that they work out of the box.
2. Provide a composer.libraries.json merge command so that the plugins don't have to be added to the project's composer file.

The easiest way to solve this is to work with the maintainers of both of these contrib module and provide patches that will enable this behaviour via those modules. There is also a way for Sector to implement (2) directly.

Discussion

There's an existing issue around the merge plugin for Anchor Link: 🐛 Adjust composer.libraries.json to match webform standards and prevent webform issues Closed: won't fix

There is also an issue on Anchor Link for using an experimental composer repository 📌 Start a 3.0.x branch for CKEditor Anchor Link for semantic versioning and better integration with Drupal 10, CKEditor 5, and LinkIt Fixed

The original blog post behind this repository: https://www.mydropwizard.com/blog/experimental-composer-repository-ckedi...

This would reduce our "repositories" load from 3+ CKEditor plugins to just the following:

"drupal-ckeditor-plugins": {
  "type": "composer",
  "url": "https://panopoly.gitlab.io/drupal-ckeditor-plugins"
}

This does add an outside dependency on Panopoly, but we could also maintain our own version of the equivalent.

We can also consider doing the following:

• Create issues in both the linkit and wysiwyg_templates modules for CDN support.
• Include the proposed patches into Sector.

Hopefully this is enough information to start a discussion on where to take this and how to solve the problem.