#5676: Restore sandbox for nunjucks and handlebars

[fregante]

What does this PR do?

• Closes Enable Sandbox for template rendering #5676

This was added last year but was disabled due to issues with JQ (#4964). JQ has since been removed from the sandbox (#6579).

In any case the memory issue didn't appear to be solvable via Transferable objects (because only ArrayBuffer is transferable, and we'd need to duplicate the object into it before transferring it, voiding any possible memory savings)

Discussion

• Is this all that's needed here?

Demo

Screen.Recording.mov

Future work

• Future: Move sandbox execution to ShadowRealms #6580

Checklist

• Add tests
• New files added to src/tsconfig.strictNullChecks.json (if possible)
• Designate a primary reviewer: @twschiller

[twschiller]

@fregante @grahamlangford marking as "do not merge" because we'll want to save this for 1.8.6 or feature flag it

[twschiller]

I think we're OK to merge this now testing. But if we include in 1.8.6, I'd want to put behind a skunkworks flag

I'm worried about some host pages in the wild somehow mucking with injected iframes: https://pixiebrix.slack.com/archives/C023KL47XV4/p1702844878608309

We might even have to use an offscreen background document in those cases: https://developer.chrome.com/docs/extensions/reference/api/offscreen

cc @grahamlangford

[grahamlangford]

I've created a ticket to hide the sandbox behavior behind a skunkworks flag: #7150

[github-actions]

No loom links were found in the first post. Please add one there if you'd like to it to appear on Slack.

Do not edit this comment manually.