* policy: load the CLI policy file from an internal package
The plugin and theme registries need to read the policy too, and
internal packages cannot import package main.
* registries: let the CLI policy turn the registries off
With disable_registries set in /usr/share/dms/cli-policy.json or
/etc/dms/cli-policy.json (the /etc file wins), the plugin and theme
registries start without sources, so nothing is cloned or pulled.
Installed plugins and themes keep working.
