Add ability to safely analyze without executing project.clj about clojure-lsp

[ericdallo]

Thanks for the report @technomancy, clojure-lsp has a general waterfall settings checking from project to home dir, but maybe we could check only the home one for this one somehow.
Also we don't have ATM a way to fallback for classpath lookup commands, we would need to support that, unless we think in a way the fallback is not needed.

[technomancy]

Honestly I don't know that I have enough context to say what the right thing to do here is. Thinking about this more, there are legitimate and safe reasons to want to override the classpath command on a per-project basis; maybe clojure-lsp guesses wrong and you want the project to set an override to a different command, but the other command is still safe.

I've never used deps.edn or any of the other classpath calculation tools. Are they safe to run on untrusted projects? (Disabling *read-eval* etc?) I see that there is also a :java-command config setting which could trivially be overridden by an untrusted project to run arbitrary code.

It's clear to me that my original suggestion of "avoid lein classpath and use lein static-classpath instead" is insufficient for the purposes of achieving "opening an untrusted file shouldn't pwn your system"; it's a small part of the puzzle, but there's a lot more to it. From my perspective, I want to make sure that static-classpath is available for people who want to do the work of making the tooling safe, but I don't think I can be the one to do that work, and I don't know how much of a priority it is for the maintainers of clojure-lsp.