Comment 7 for bug 1997417

Thank you Marc.
In a discussion we have further clarified that this is even true with mozjs staying in main.
"we prefer maintaining duktape than have polkit, which is security sensitive, use mozjs"
So it is in particular about getting it out of a stack that authenticates.

Hence this goes into my prepared secondary answer, which is Ack under constraints.
Here Seb already said: "and we are working on the testing story" which is great.
And I'm assigning to security for review.