assist SES / Jessie users with Trojan Source risk?

[dckc]

SES includes scans for some lexical forms (HTML comments, ...) that it cannot secure.

The Trojan Source risk does not seem directly relevant to the SES security model, but adding a scan to the Jessie lint rules or some such seems consistent with the goal of a dialect that "non-experts can use to write non-trivial non-exploitable smart contracts" and perhaps optional support in SES is cost-effective.

for reference:

• Trojan Source Attacks
• Node.js project review of CVE-2021-42574 and CVE-2021-42694
• how to address Trojan Source risk? CVE-2021-42574 · Issue #4017 · Agoric/agoric-sdk

cc @michaelfig @mhofman @kriskowal