fix: prevent node mode to be used as script runner by other apps

[zcbenz]

Description of Change

See the code comment for the purpose of this change:

// On macOS, it is forbidden to run sandboxed app with custom arguments
// from another app, i.e. args are discarded in following call:
//   exec("Sandboxed.app", ["--custom-args-will-be-discarded"])
// However it is possible to bypass the restriction by abusing the node mode
// of Electron apps:
//   exec("Electron.app", {env: {ELECTRON_RUN_AS_NODE: "1",
//                               NODE_OPTIONS: "--require 'bad.js'"}})
// To prevent Electron apps from being used to work around macOS security
// restrictions, when NODE_OPTIONS is passed it will be checked whether
// this process is invoked by its own app.

Note that this change is only needed on macOS, because on other platforms there is no restriction on invoking another app with custom arguments. In other words, this change is merely to satisfy the security requirements in Apple's ecosystem.

Checklist

• PR description included and stakeholders cc'd
• npm test passes
• tests are changed or added
• relevant documentation, tutorials, templates and examples are changed or added
• PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, and past tense.

Release Notes

Notes: Prevent node mode to be used as script runner by other apps on macOS.

[zcbenz]

/cc @deepak1556 @bpasero this change will get rid of the patch used by VS Code, please check if there will be any unwanted behavior.

[deepak1556]

💯 for the tests!

[release-clerk]

Release Notes Persisted

Prevent node mode to be used as script runner by other apps on macOS.

[trop]

I was unable to backport this PR to "26-x-y" cleanly;
you will need to perform this backport manually.

[trop]

I was unable to backport this PR to "27-x-y" cleanly;
you will need to perform this backport manually.

[trop]

I have automatically backported this PR to "28-x-y", please check out #40710

[trop]

@zcbenz has manually backported this PR to "27-x-y", please check out #40737

[trop]

@zcbenz has manually backported this PR to "26-x-y", please check out #40738