Support Module Source Worker Instantiation

[guybedford]

This is draft HTML PR spec text to verify the cross-specification interactions of the ESM Source Phase proposal, specifying:

• Integrating JS module sources with HTML source phase imports.
• new Worker(moduleSource) for both JS and Wasm module sources, based on the new HostGetModuleSourceModuleRecord host hook and GetModuleSourceModuleRecord concrete method.
• import(moduleSource) based on the updated HostLoadImportedModule API, with full registry key coalescing based on module source equivalence via the new ModuleSourcesEqual concrete method.
• When doing a ModuleSourcesEqual check, only registry rooted sources are treated as equivalent in this check, which have a rooted source value. These correspond to "evalish" modules. See the security section below for more info.
• postMessage(moduleSource) based on supported structured serialize and deserialize for JS source objects with a [[SourceTextModuleRecord]] slot (Wasm's support already being defined in https://www.w3.org/TR/wasm-web-api-2/ as always being unrooted transfer, yet to be updated to support rooted transfer in turn).

This is based to the latest version of ESM Phase Imports (https://tc39.es/proposal-esm-phase-imports/).

The WebAssembly ESM Integration side of this has now been landed including support in HostGetModuleRecordFromSource being able to synthesize a module record when needed for import() or new Worker().

In order to extend WebAssembly's structured clone of WebAssembly.Module to also support serialization of the URL an rooted source properties of the WebAssembly module script, the associated PR to the Wasm Web API is needed - WebAssembly/esm-integration#106. This PR also defines ModuleSourcesEqual for WA.Module needed for registry identity with structured clone semantics.

There is some discussion to be had around the security model here, to outline the approach:

• We define a rooted source to distinguish between sources known by the host to have been provided from the module registry to their base URL directly to the origin and evalish / compiled sources (eg new WebAssembly.Module(bytes) today and in future eval('module {...}') or new ModuleSource('export var foo')).
• We also include sources as non rooted sources when their responseURL does not match their baseURL for consistency with the rooted source semantics.
• We then only set the worker URL to the URL of the source when it is a rooted source, and otherwise set the worker URL to null.
• Similarly we only carry through the cross-origin isolated capability when it is a rooted source.
• When transferring via postMessage a module created dynamically eg via new WebAssembly.Module(bytes), we transfer the rooted source status and then transfer baseURL from the parent to the child along with the module only when it is a rooted source. This way, for rooted sources, relative paths that worked in the parent can still work in the child.
• Module declarations / expressions that are not created via eval are expected to themselves be rooted sources effectively via their parent context (perhaps transferring with their parent in the module registry).

Shared workers and worklets are not currently supported but could be nice additions.