fix(security): restrict dashboard plugin backend auto-import to bundled plugins — defense-in-depth (#43719)