Document broker interface

[lawnsea]

Starting point from TODO:

• on startup, register single listener and wait for config object
• config object contains the following:
  • properties:
    • ignore: array of string property names to not defProp
    • retain: array of string property names to not set value (they will still
      be defProp'd) this is to support importScripts
  • scripts
    • trusted: trusted scripts written in a safe subset of JS (cajita?) that
      get access to zero or more privileged tokens
      • array of objects
        • env: array of privileged symbols
        • src: string of JS to eval
    • untrusted: array of scripts to import
• on receipt of config
  • clobber globals
  • import scripts (first one sets importScripts to null)
  • postMessage 'ready'