Investigate ability to tolerate Function constructor permissiveness

[erights]

No description provided.

[erights]

The following check would be fooled by the Function constructor permissiveness being considered.

endo/packages/ses/src/make-function-constructor.js

Lines 29 to 35 in e9199f4

	// Are parameters and bodyText valid code, or is someone
	// attempting an injection attack? This will throw a SyntaxError if:
	// - parameters doesn't parse as parameters
	// - bodyText doesn't parse as a function body
	// - either contain a call to super() or references a super property.
	// eslint-disable-next-line no-new
	new FERAL_FUNCTION(parameters, bodyText);

However, it could easily be changed to not be vulnerable, by making two calls to FERAL_FUNCTION instead of one

new FERAL_FUNCTION(parameters, '');
new FERAL_FUNCTION(bodyText);

Attn @phoddie @kriskowal @dckc @bakkot