fix: tame Error constructor

[erights]

An initial taming of the Error constructor that should both be safe enough and compat enough for cases we've seen.

Build on the partial-intrinsic-reform branch, which set the stage.

Current a Draft PR because none of this is tested yet.

[warner]

I don't know if this is supposed to work or not, but this branch (at commit a04148a) did not allow a prepareStackTrace/stackTraceLimit -using library to work. My test program is:

import 'ses';
import callsites from 'callsites';
lockdown();
console.log(callsites());

callsites uses Error.prepareStackTrace. I don't know that we need that particular library to work, but it exercises a pattern similar to what we've identified in libraries that we do need, and it's currently present in the dependency graph of both agoric-sdk and SES-shim. You should be able to run that test program from any directory of the SES-shim tree.

If I comment out the lockdown(), the program prints a bunch of empty Callsite objects. With lockdown(), it throws a TypeError because Error is not extensible.

[warner]

I think the base use case would work, so this would be a step forward for compatibility. The "safe" mode seems fine to me, and the "unsafe" mode can't get any more unsafe :). So I'd say go ahead and land this, but let's make sure we figure out the non-v8 and nesting cases before we call this done.

[erights]

@warner to address the infinite recursion, enough changed that I re-requested a review. PTAL

[warner]

Looks great. Maybe add one comment, and take a brief look at my captureStackTrace comment, but otherwise it looks ready for landing to me.