feat(bundle-source): Apply evasive transforms to Endo archives

[kriskowal]

• chore(bundle-source): Upgrade compartment-mapper to v0.2.4
• chore: Update yarn.lock
• feat(bundle-source): Apply transforms to endoZipBase64
• fix(bundle-source): Transform inner comments

refs: #2684

Description

SES censors any script or module that appears to use dynamic import.
Since the SES runtime is lightweight and risk averse, it uses a regular expression to detect this pattern, but there are many false positives, particularly apparent dynamic import within comments.
These are common especially in JSDoc comments with TypeScript imports.
The getExports and nestedEvaluate bundle formats apply a parser-based transform that rewrites comments such that SES won't censor them.

This change brings these existing transforms to bear on the individual files of an Endo compartment when using the new endoZipBase64 bundle type.
To facilitate this, a new version of the compartment mapper provides a "module transforms" hook.

The getExports and nestedEvaluate bundle formats also give Rollup a turn at transforming the input sources.
This alters the shape of the AST such that "inner comments" never occur.
An "inner comment" is a comment that neither leads nor follows non-comment code.
Such comments are common specifically in files like the conventional types.js that consists entirely of TypeScript JSDocs.

Since Endo doesn't preprocess files with Rollup, the comment rewriting transform needs to traverse this previously unexplored branch of the syntax trees.

Security Considerations

This change alters the presentation of client code to SES.
It should do so in a way that is semantically equivalent.
SES does not rely on these transformations to enforce integrity.

Documentation Considerations

This change does not require further documentation.
Users may notice in their debugger that comments with import will see Ximport instead.
The intention is to relieve the concern of SES censorship from the authors of client code, particularly third-party module authors who do not anticipate their code being executed in a SES environment.

Testing Considerations

This change introduces a new test for the inner comments.
Sufficient coverage of Endo should occur through real usage throughout the Agoric SDK, as we shift from using nestedEvaluate to endoZipBase64.

[michaelfig]

LGTM!