[web-api] Restrict WebAssembly.Module to same origin

[annevk]

As discussed and per the rationale at whatwg/html#4920.

Once whatwg/html#4940 lands this will be trivial to define. Mostly raising this in case there are concerns.

[KronicDeth]

Is this part of the blockers for re-enabling SharedArrayBuffer by default in Firefox?

[annevk]

Not really. This is mostly about making it easier in the future to reduce the scope of an agent cluster if we manage to get rid of document.domain somehow.

[annevk]

This isn't really needed. It seems the serialization/deserialization restrictions around WebAssembly.Module are mostly artificial.