Add security warning for ambiguous source maps

[nicolo-ribaudo]

It was pointed out during the October 2024 plenary that being able to cause a tool to perform a network request can be used for tracking purposes, and thus it should be possible to statically know whether a file links to a source map or not.

The problem is that, given that we have multiple linking methods that give different results, it's not unlikely that ambiguous source map comments can skip through reviews and checks.

There was a solution that we collectively came up with, but we did not want to change the specification at this point given that we need to discuss it in TG4 and go through the implications of it.

Approval on publishing the first edition of our spec was conditional of explicitly calling out (in a note / not normative section) the implications of the ambiguity, and how a potential solution would look like. Our specification already points to the living draft, and thus it's ok if we just work on the actual fix in the living draft.

The proposed fix is very likely to affect no actual usages of source maps, but we need to check in TG4 if it needs to be tweaked. I'll open an issue to better discuss it.

Examples of ambiguous comments:

let a = `
//# sourceMappingURL=foo.map
// `;

let a = "\
//# sourceMappingURL=foo.map"

let a = '\
//# sourceMappingURL=foo.map'

//# sourceMappingURL=bar.map
/*
//# sourceMappingURL=foo.map
// */

This PR needs to be merged today, because we need to start the 60 days period and this is a requirement for it. The pull request does not contain any normative changes, and is entirely an editorial decision.

[nicolo-ribaudo]

This is how that section looks like now:

[littledan]

LGTM but note that, because this doesn’t have normative content, it doesn’t affect the 60 day opt out period.