Add as_app_set_trust_flags()

This allows us to be more careful with untrusted data.
Assume local files are untrusted when parsing