feat: use isolated-vm to run integration scripts

[pierre-lehnen-rc]

Proposed changes (including videos or screenshots)

This PR adds an option on the webhooks form to select if the custom script should be executed in secure or compatible mode. Compatible mode will continue to use vm2 to run the scripts, while the secure mode will use isolated-vm instead.
Old scripts written for vm2 should mostly be compatible with isolated-vm as well, but we've taken this opportunity to also limit what's available on the script sandbox so some internal functions that are available to vm2 will be undefined for scripts running on isolated-vm.

The envvars that manage custom scripts now also support specifying only one of the scripts engine, with the values "vm2" and "ivm".
So if the envvar FREEZE_INTEGRATION_SCRIPTS is set to "vm2", use of isolated-vm will be mandatory for new or modified scripts, but vm2 will continue to work for older scripts that have not been modified.
Once you change a script to run in isolated-vm you can no longer switch back to vm2 if vm2 is frozen.

If DISABLE_INTEGRATION_SCRIPTS is set to "vm2", those scripts will be ignored and only scripts set to isolated-vm will be executed.

Issue(s)

https://rocketchat.atlassian.net/browse/ARCH-1167

Steps to test or reproduce

Further comments

[changeset-bot]

🦋 Changeset detected

Latest commit: 955b37d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 30 packages

Name	Type
@rocket.chat/core-typings	Minor
@rocket.chat/rest-typings	Minor
@rocket.chat/tools	Minor
@rocket.chat/meteor	Minor
@rocket.chat/core-services	Patch
@rocket.chat/cron	Patch
@rocket.chat/gazzodown	Major
@rocket.chat/livechat	Patch
@rocket.chat/model-typings	Patch
@rocket.chat/ui-contexts	Major
@rocket.chat/account-service	Patch
@rocket.chat/authorization-service	Patch
@rocket.chat/ddp-streamer	Patch
@rocket.chat/omnichannel-transcript	Patch
@rocket.chat/presence-service	Patch
@rocket.chat/queue-worker	Patch
@rocket.chat/stream-hub-service	Patch
@rocket.chat/api-client	Patch
@rocket.chat/omnichannel-services	Patch
@rocket.chat/pdf-worker	Patch
@rocket.chat/presence	Patch
rocketchat-services	Patch
@rocket.chat/ddp-client	Patch
@rocket.chat/fuselage-ui-kit	Major
@rocket.chat/models	Patch
@rocket.chat/ui-client	Major
@rocket.chat/ui-video-conf	Major
@rocket.chat/uikit-playground	Patch
@rocket.chat/web-ui-registration	Major
@rocket.chat/instance-status	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

Merging #30229 (955b37d) into develop (12e66c0) will increase coverage by 0.05%.
Report is 1 commits behind head on develop.
The diff coverage is n/a.

@@             Coverage Diff             @@
##           develop   #30229      +/-   ##
===========================================
+ Coverage    50.23%   50.29%   +0.05%     
===========================================
  Files          780      775       -5     
  Lines        14476    14459      -17     
  Branches      2617     2613       -4     
===========================================
  Hits          7272     7272              
+ Misses        6809     6780      -29     
- Partials       395      407      +12     

Flag	Coverage Δ
e2e	48.67% <ø> (+0.07%)	⬆️
unit	60.80% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.