Add optional `icon`

[aaronpowell]

Summary

Add an optional icon field to the plugin manifest so hosts can display a
visual identifier for a plugin in UIs (marketplaces, settings, pickers).

Proposal

Add an optional icon string field to plugin.json. The value is either:

• a plugin-relative path (per §4.1: MUST begin with ./, resolve against
  the plugin root, and remain within it), or
• an absolute HTTPS URL to an image.

Recommended image: square, at least 512x512.

Open design questions

These need to be settled in the spec text, not just the schema:

1. Failure behavior. If icon is a path that escapes the plugin root, or a
   malformed/non-HTTPS URL, is the manifest fatal-invalid or is the field
   ignored (non-fatal)? Proposed: non-fatal — hosts MUST ignore an invalid
   icon and continue loading, consistent with the cosmetic nature of the field.
2. Remote fetching. May a host fetch a remote icon at load time? §5.2
   forbids retrieving schemas during load for SSRF/privacy reasons; a remote
   icon has similar concerns. Proposed: fetching is OPTIONAL and host-defined;
   remote URLs MUST be HTTPS.
3. Allowed formats. Enumerate (e.g., PNG) or leave host-defined? SVG carries
   script-injection risk and probably should be excluded.
4. Normative strength. Should the square / 512x512 guidance be SHOULD
   (normative) or a lowercase recommendation?

Proposed changes

• Add icon to the JSON schema (schemas/1.0.0/plugin.schema.json).
• Document icon in the metadata field table (§5.4) and add a dedicated
  subsection.
• Reference §4.1 for the plugin-relative path rules and §7.2.4-style URL rules.
• Specify the failure behavior chosen above.

Example

{
  "$schema": "https://open-plugins.com/schemas/1.0.0/plugin.schema.json",
  "name": "plugin-name",
  "icon": "./icon.png",
  "version": "1.2.0"
}