bug#45198: 28.0.50; Sandbox mode

[Stefan Monnier]

>> As we gain more experience with these sandboxing mechanisms, we can look
>> at relaxing these restrictions, but I think initially we should
>> be conservative.
>
> I take the opposite view, but our goals are the same and we will converge.

I guess the conversion goes like:
- define "low-level" interfaces to OS-specific functionality.  They can
  be as close to the OS's own featureset as we want.  They don't
  really need to be stable over time (especially not at the beginning).
- define an OS-agnostic API on top of them.  This one needs to be
  conservative and should evolve more slowly, paying attention to
  backward compatibility.


        Stefan