src,permission: disable WASI when pm is enabled

Following up https://hackerone.com/reports/2470213.

The permission model currently does not cover WASI by default, and that's expected. But, it seems that I failed to document it properly (A (brief) documentation effort was made on https://github.com/nodejs/node/pull/47782). I am creating a --allow-wasi flag to address this issue and potentially block WASI entirely.