[no squash] Remove insecure environment from async and emerge environment

[sfan5]

fixes #13092 (comment)
since this affects the async environment too we should create a security advisory (done)

this situation does not have an obvious fix:
At the time register_mapgen_script is called the engine trusts the mod name. But this isn't safe because mods can (intentionally or unintentionally) call into each other's code.

• restricting register_mapgen_script to the top level (like request_insecure_environment) would be inconvenient
• in addition that still doesn't work if the mod registers a script at a global-writable location (e.g. world path)
• alternatively:
• the engine can tell which mod folder a file originated from
• but then the internal code needs to be reworked to differentiate between
  • "we know which mod is probably running" (get_current_modname would use this because it needs to stay working)
  • "we know which mod is running and trust this value" (requirement for request_insecure_environment)
• also quite inconvenient

So I chose to just remove the feature.

To do

This PR is Ready for Review.

How to test

1. make sure lua still works in general
2. make sure request_insecure_environment still works

[Desour]

LGTM.