Separate suggested builders from trusted default builders

[joshwlewis]

Description

Currently, the suggested builder list has two functions that I am aware of: 1) it's the output of pack builder suggest and 2) it's the list of builders that are trusted by default.

This poses a difficulty for a vendor who wants a builder that is trusted by default, but would rather not suggest it to developers.

In my case, Heroku has a builder called heroku/builder-classic:22. This is a builder with shimmed Heroku V2 buildpacks. It's useful for folks who need some of the legacy language features from our V2 buildpacks, but since these are shimmed CNBs, we hardly think the builder should be recommended for general use.

Another use case is retiring builders. At some point in the future, we'll want to retire heroku/buildpacks:20. At that point, we'd like to stop suggesting it to new users, but it should probably be trusted by default up until most folks stop using it.

Proposed solution

Separate lists for "suggested" builders and "trusted by default" builders. The lists might have many of the same entries at first, but each could change independently over time.

Describe alternatives you've considered

The suggested builder list could be a subset of the trusted by default (or just trusted) list.

[dfreilich]

Interesting use case! I definitely think it makes sense. The lists represent different things and should be disjoint.

We'd welcome a PR to make it happen!

[natalieparellano]

Now that suggested builders contain extensions (see buildpacks/community#244) and extensions can't be used with the trusted flow, this would be even more useful