Entity box

Merge #2330 before reviewing this.

Adds box support to the DataSource layer via `BoxGraphics` and `Entity.box`.
For better or for worse, all of the updater classes are public.  The reason for this is so you can customize the list of visualizers used by DataSourceDisplay.  It would be odd to make this private without making the rest of them private.  At some point down the line we can assess whether the ability to customize the list of visualizers still makes sense, and if not make them all private (or do it just to reduce API footprint).  But for now I would leave them as is.