Implement support for running vats in web workers to enable SQLite to have synchronous OPFS access

[FUDCo]

We need to provide an option to run vats inside web workers instead of iframes.

Currently, all vats run inside iframes, but this is incompatible with synchronous access to persistent storage. The vats' nominal persistent storage is realized by SQLite, which inside iframes is limited to operating in memory-only mode, which in turn means that vats are in reality ephemeral (note that switching to something other than SQLite won't help, because the issue is synchronous vs. asynchronous storage access per se, not the particular storage API). By instead running vats inside web workers, SQLite can employ the OPFS synchronous file access mode and thus support a truly persistent vatstore. This switch comes with an important caveat, however. While running vats in web workers rather than iframes is, in principle, very straightforward, allowing even a modest number of vats to do this results a substantial performance penalty due to the brain dead way most browsers implement web workers. Consequently, we need to support both options (iframe or web worker) concurrently, governed by vat configuration, so that synchronous file access can be granted to a small, selected subset of vats while the rest remain ephemeral.

Longer term, there are other strategies for providing true persistence while supporting vats' need for (apparent) synchronous storage access despite the fact that iframes don't allow for this, but these strategies are considerably more complicated and are entangled with the kernel's vat execution model, making this a longer term effort. That will be subject of a separate issue (I will put a pointer to that issue here once it has been created).

[sirtimid]

Ii seems this is not easily feasible:

• Eval is disabled: Regular extension pages disable eval by default. This causes SES to fail when launching a webworker from the offscreen.
• Issues with iframes: Iframes allow eval because they're sandboxed, but they get a null origin. Webworkers can't be loaded from a null origin, so that doesn't work.
• Blob workaround didn't work: I tried using a blob inside an iframe, but it requires all the code to be bundled and self-contained—runtime resolution of relative module imports isn't allowed. Even after bundling, I encountered issues because sqlite-wasm uses module workers by default, which needed extra transformation.
• Lockdown eval setting ineffective: I also hoped that setting evalTaming: 'noEval' on lockdown would prevent the use of eval, but that didn't work either.

At this point, I had to stop due to the growing complexity, including the need for a separate Vite build config for the vat webworker.

#409

[rekmarks]

This is infeasible.