Disable extra plugins

This pull requests disables the install button via UI by default and adds a banner to the admin pages.
Users can still re-enable it via the wp cli.
TBD if this is enough. wp is not documented anywhere, only expert users would be familiar with it...
One option would be to protect the wp cli as well. Do users need access to it?

Before:

After: