[Security] Arbitrary code execution through unrestricted DLL scanning in PluginDiscovery

## Summary

`PluginDiscovery.Scan()` resolves the scan path from `Assembly.GetExecutingAssembly().Location` / `Environment.ProcessPath` and enumerates **all** `*.dll` files in the application's output directory that match `ScanAssemblyPatterns` (default: `FluentCMS.Plugins.*`). Any DLL placed in that directory will be loaded and executed with the application's full trust level on next startup.

## Location

`Plugins/FluentCMS.Infrastructure.Plugins/Discovery/PluginDiscovery.cs` — `Scan()` method (~line 42)

## Risk

A supply-chain or filesystem-level attacker can drop a malicious DLL matching the naming pattern and have arbitrary code execute at application startup. There is no:

- File signature / hash verification
- Allowlist of trusted publishers (Authenticode)
- Sandbox or isolated execution

## Reproduction

1. Build the host application.
2. Copy a malicious DLL named `FluentCMS.Plugins.Evil.dll` into the output directory.
3. Restart the application — the DLL is discovered, loaded, and any `IPluginStartup` implementation executes.

## Recommendation

1. Allow operators to configure an **explicit, out-of-tree plugin directory** instead of defaulting to the host binary directory:
```csharp
options.PluginDirectory = "/opt/myapp/plugins"; // separate from binaries
```
2. Optionally add **file hash verification** or **Authenticode certificate validation** before loading each assembly.
3. Consider a plugin allowlist (name + expected hash) stored in a protected configuration location.

## Severity

🔴 **Critical / Security**

Commencez dans Plugins/FluentCMS.Infrastructure.Plugins/Discovery/PluginDiscovery.cs, en vous concentrant sur la méthode Scan() et son utilisation de ScanAssemblyPatterns, Assembly.GetExecutingAssembly().Location et Environment.ProcessPath. Examinez le fonctionnement du chargement des plugins et de l’exécution de IPluginStartup, puis définissez l’approche de configuration des répertoires et de vérification des assemblies qui sera adoptée ; le travail est terminé lorsque les DLL correspondantes ne sont pas chargées depuis le répertoire de sortie de l’hôte sans les contrôles de confiance sélectionnés.

Rédigé par le modèle d'indexation à partir du texte de l'issue.