This allows UI scripts (saved in preferences) to access
os.* functions (non-sandboxed), while preventing other
scripts to do so.
Lua scripts that can run os commands can execute arbitrary
code on the system. While this is a nice feature, it can be
equally dangerous.
Without this, Editor::button_release_handler() will handle a button3 press
without checking for an active drag, resulting in two drags, and two reversible
commands, and an abort ...
Playlist::split can result in removal of a region
(adding two others instead). In this case the state
of the removed region (if modified) is not saved.
This involved a significant change in event handling for automation region views,
but it brings it into line with how it works for other things. On button press
we initiate a drag, then if no motion occurs, the Drag returns false during
finalization, and only then do we continue through Editor::button_release_handler()
to eventually end up in ::add_automation_event().
Although it is a substantial change, the fact that it now works the same
way for audio regions, automation regions and automation tracks seems
like a definite plus.
Drag::_raw_grab_time is set to the correct time-domain. However
during ::motion() and other operations the adjusted time was
always AudioTime.
Most notably this caused editor->selection->time to have
different time-domains for start and end.
I/O plugin Controls are destroyed with ~IOPlug, however
Session::destroy()'s call to drop_references() still
triggers AutomationControl::session_going_away() on the
binding proxy.
This is even properly documented in session_object.h:
> A named object associated with a Session. Objects derived
> from this class are expected to be destroyed before the
> session calls drop_references().
