doc: clarify the scope of --disallow-code-generation-from-strings

[legendecas]

Fixes: #58221

[ChALkeR]

No.

Documenting the incomplete behavior and setting it in stone would be more problematic, I think.

Instead, #28614 should have respected this flag

Not doing that that is hardly helpful and makes this flag close to useless.
While doing that will very unlikely break anything.

Also the path of least surprise in the behavior is blocking data imports on that flag, like browsers do with CSP.

See also explanation in #58221

[legendecas]

Node.js does not support CSP. This flag was originally exposed as a V8 flag, and documented in Node.js, only supporting guarding the listed APIs.

#28614 did nothing wrong as the flag was never meant to interfere module system, including require and import. Module APIs like module loaders (specifically the load hook, as it loads modules as source strings), require.extensions and CJS module._compile are all compiling module codes as string in JavaScript and I don't see it is possible to disable the whole module system for this flag.

[ChALkeR]

cc @nodejs/tsc pls discuss this

[aduh95]

Adding a request for change so this doesn't land without @ChALkeR's objection getting dismissed by either Nikita or a TSC vote.