meta: clarify V8 flags are outside threat model

[mcollina]

We cannot be responsible for V8 experimental features in case they cause security problems.

[nodejs-github-bot]

Review requested:

• @nodejs/tsc

[Renegade334]

--harmony is deprecated terminology in V8, and new features haven't used it for some time. I would suggest something like

Node.js may expose in-development V8 features that are only available via --js-* or --harmony-* runtime flags (e.g., --js-decorators, --harmony-shadowrealm).

--js-staging is the new global flag equivalent of --harmony.

[legendecas]

In light of V8 flags, we should explicitly exclude all V8 flags from the security model. For example, the following V8 flags are much more vulnerable than experimental JS features:

• --allow-natives-syntax exposes %DeoptimizeFunction, %CollectGarbage, and hundreds of other runtime intrinsics that can corrupt heap state or leak internal objects.
• --predictable disables all non-determinism including randomized allocations, weakening ASLR-style protections.

There are a bunch of V8 flags in additional to these that make the process more vulnerable.

[aduh95]

This repeats most if not all of the Experimental features behind compile-time flags section. I wonder if we could simply merge the two sections, i.e. Experimental features behind compile-time flags and V8 runtime flags