`--safe` option that only allows safe plotting options

[mgajda]

While diversity is great feature, sometimes one would like to call pandoc-plot on Markdown of unknown origin.
In such case it would be nice to have --safe option that disables all those plotting libraries that can execute arbitrary code.

This would probably allow only gnuplot, graphviz, plantuml, and ggplot2 without shell escape.

To disable shell escape in gnuplot it may be sufficient to run with environment variable set: SHELL=/bin/false gnuplot.
As far as I know graphviz and plantuml allow no shell escape.

[LaurentRDC]

That's a good suggestion.

I don't have time to implement it myself, but I'm happy to review pull requests for this feature.