Entity box

Merge #2330 before reviewing this.

Adds box support to the DataSource layer via `BoxGraphics` and `Entity.box`.
Should this be private?  It is not in CHANGES.md.  Or maybe we already had this discussion before 1.0?