Allow grabbing additional loot

[kpcyrd]

If a script wants to provide additional data of the user, the script could be changed from:

return is_valid

to something like

if is_valid then
    req = http_request(session, 'GET', 'https://example.com/api/permissions', {})
    resp = http_send(req)
    if last_err() then
        -- ignore this error and just report the login as valid instead of requeueing it
        clear_err()
        return true
    end
    loot['permissions'] = resp['text']
    return true
else
    return false
end

badtouch would need to add a dict/table named loot to the lua context before executing the script. After the script finished with success the loot table would be checked and if it's non-empty that data would be included in the report. This is difficult to fit into the regular combolist report we currently use, so we might have to limit this to json reports (and support json reports).