fix(nuxt): restrict access to single renderer outside of test/rootDir

[danielroe]

🔗 Linked issue

❓ Type of change

• 📖 Documentation (updates to the documentation or readme)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

In dev mode, it was possible to import arbitrary paths via the /__nuxt_component_test__ endpoint. That is a problem because if you click a crafted URL you could execute JS on someone's dev server. This change restricts that to test mode only (also adding process.test) which does not listen to a public hostname. In addition, we also ensure that any imports are located within the project rootDir.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[codesandbox]

  Open in CodeSandbox Web Editor | VS Code | VS Code Insiders