VM: 'nim e' etc, default to the VM's sandboxing behaviour

[Araq]

• affects Nimble's Nimscript integration
• New default is the sandboxed VM.
• Use 'nim edanger' to run without the sandbox.

[timotheecour]

• This is a breaking change, and should be rolled out more gradually by first introducing an optional sandbox instead, and only in future work (if needed) turning that sandbox into the default.

• We should have a flag insted of a new command, it's more orthogonal (eg that vmsandox:on|off flag would be usable with all commands, including things like nim --eval, nim doc nim r nim e automatically). eg, a flag can be over-ridden on cmdline, but not a command, etc. Plus, naming is confusing (-d:danger has nothing to do with edanger un-sandboxing)

• Note that we already have: --experimental:vmopsDanger with very similar intentions; why not reuse that, or, rather, use a similarly named one --experimental:vmsandbox which would be off by default for now, and in future work could be turned on (if needed)

EDIT: see also

• Safety of staticRead and StaticExec? - Nim forum
• https://forum.nim-lang.org/t/5315#48992
• --experimental:vmsandbox, --experimental:vmopsDanger · Issue #767 · timotheecour/Nim

[Araq]

Ok, well for now this was to see what it breaks.