Overhaul of the plugin maintenance/system

Description

This is a topic which spans over multiple repositories:

• plugin-channel
• updated-plugins
• micro
• all dedicated plugin repositories (present inside micro-editor)
• 3rd-party channels etc.

Current situation:
We have a lot of plugins which are currently "maintained" inside one single "large" updated-plugins repository, which are somehow old forks or the last "actual" state. On top of that we have plugin-channel which point to plugins inside updated-plugins or the upstream locations.
Both repositories have in common that they store the binary artifacts of every tracked version in one release...

• https://github.com/micro-editor/plugin-channel/releases/tag/plugins
• https://github.com/micro-editor/updated-plugins/releases/tag/v1.0.0
  ...so they are uploaded manually...for each plugin.
  The traceability is actually an absolute pain.
  Right now there is no authentication check available for any plugin.

channel.json points to...

• https://github.com/micro-editor/plugin-channel/tree/master/plugins/*.json
• https://github.com/micro-editor/updated-plugins/tree/master/**/*.json
  ...which point to "internal" as well as external resources.

Target situation:
Each plugin shall be tracked within one single repository, whether it's one of micro-editor or a third party.
Each version of each plugin must be tracked with its version number AND tag fitting together. Based on the tags GitHub will already create "snapshots" of the actual repository content, archive them to a zip and tar.gz, which then can be linked as artifact (actually no need to track further manually uploaded binaries/artifacts).
The *.json's pointing to the concrete files/versions should include (for future) revisions an entry for the hash of the file, to provide at least some sort of authenticity.
Unfortunately GitHub's tag snapshots don't generate a SHA256 on its own.

We need a plan where the master *.json is tracked and which location it shall point to.
I think we can agree, that the micro team can't maintain every possible plugin, but the question is, if it shall curate the plugins and point to fixed releases?

Start with channel.json and the plugin metadata under plugin-channel/plugins/.json and updated-plugins/**/.json, then compare the linked release and repository layouts. A complete result would define the repository ownership model, version/tag references, artifact links, and future hash fields across the named repositories; the issue does not identify an implementation entry point or tests.