Remove the `allowed_projects` configuration option

Yeah, this is gonna need a backport.

Assigning to @tim.plunkett for review, commit, and backport. I think this change will make a lot of sense to him and he'll have a clear sense about whether the update path is sound.

Decided to postpone this on https://www.drupal.org/project/project_browser/issues/3305614 ✨ Allow a module to be blocked from display on Project Browser Active , which I think would be a good place to add more generalized support for allow/deny lists in sources.

After thinking about how this would relate to ✨ Allow a module to be blocked from display on Project Browser Active , I decided to change direction here.

Since it makes no logical sense to have both an allow list and a deny list operating on the same set of projects, I think what makes sense here is:

• Remove the allowed_projects configuration entirely, with no direct replacement apart from the recommended source, which is functionally an allow-list unto itself.
• Add generic deny-list support to the recipes source (and others) in ✨ Allow a module to be blocked from display on Project Browser Active .

I can, however, see the use case for being able to filter another source through an allow-list. What I think might make sense here -- and would probably need to be a blocker for this issue -- is a whole new source, called allow_list or similar, which decorates another source and filters its results through a configured allow-list. This wouldn't be too hard to do, and it would allow great flexibility for people who want to show "just some of the results from the recipes source", without needing to fully duplicate the information by using recommended.

I've been thinking about this and here's what I propose.

There are two things we'd like to allow people to do:

1. Configure a source to hide a certain subset of its projects.
2. Find a way to wrap around a source and only show a subset of its projects.

As these are logically two different things, I think we should implement them as separate features.

The first thing is a reject list. We should implement a hide_list configuration option in ProjectBrowserSourceBase and respect it by default in createResultsPage(). This allows site admins to specifically hide certain things from users all the time (a perfect use case for this would be hiding CTools, a module which should almost never be visible to Project Browser's target audience).

The second thing is an allow list. This should probably be a totally new source, maybe called subset, which could be a decorator that takes three configuration options: decorated_id (the plugin ID to decorate), decorated_options (configuration options to pass to the decorated plugin), and query (the query array to pass to the decorated plugin, so as to guarantee that it only shows the stuff you want).

I've tested !849 manually and can verify it doesn't interfere with any base functionality of PB. Will leave Tim to provide code review, if this is the path forward - seems clear it is from the IS but not from a re-read through the comments.