Security milestone, The first one

[Jack-Works]

Things to be done in this security milestone:

• Block install scripts by default (chore(security): disable scripts to be run during install #5731)
• CVE-2021-42574 protection, should be done as a Webpack plugin. (chore: improve linter #5443)
• CVE-2021-42694 protection, same as above (chore: improve linter #5443)
• Stop using our proxy to Github packages to reduce the attack surface.
  • Remove Circle CI?
• Reproducible build by default
• Compare tools for different builds
• Enable SES lockdown (feat: introduce ses in dev #5759)
• Enable CSP ([Demand] Enable Content Security Policy #5770)
• Enable Trusted Types

[Jack-Works]

most of them are done.