Add ability to inject gradle scripts from vendor deps

[ThadHouse]

We need to think if the security connotations with this are too great, and if this opens too big of a hole

[thenetworkgrinch]

The implications may be fine if you whitelist the vendorsources in which this ability is used, like the domain or jsonUrl.

[ThadHouse]

This is kind of a terrible idea that shouldn't be done.