JS: Add a js/client-side-url-redirect sink/source for importScripts.

[erik-krogh]

Adds support for the sink and source in CVE-2020-14000.

importScripts() is a global function in WebWorkers that is used for importing scripts.
(It's used quite a lot).

Calling importScripts(url) does the same as the below document.createElement(..) snippet, but in a WebWorker.

var el = document.createElement("script");
el.src = url;
document.body.appendChild(el); // NOT OK
/// ---- Basically the same as ----
importScripts(url); 

This PR also adds support for registering postMessage(..) handlers using global.onmessage.
E.g.

self.onmessage = function (e) {
    importScripts(e); // NOT OK
}

[esbena]

LGTM. One question and a nit.

[esbena]

importScripts() and self.importScripts() are effectively equivalent — both represent importScripts() being called from inside the worker's inner scope.
(https://developer.mozilla.org/en-US/docs/Web/API/WorkerGlobalScope/importScripts)

Do we support the mentioned self.importScripts as well?

[erik-krogh]

We should - I'll add a test for it.
Edit: It worked.

[esbena]

(tests are failing though)

[erik-krogh]

(tests are failing though)

They just needed a restart.