Replace otto with goja

[htdvisser]

Summary

We should replace the unmaintained otto library with goja.

Refs #2670 and #2966

Why do we need this?

Because we should avoid unmaintained libraries, especially ones that we use to run arbitrary code.

[htdvisser]

And while at it, it would be nice to add a Prometheus histogram to get some insight in how long those scripts take

[johanstokking]

Let's do this in one go with #2670

[johanstokking]

I've spent a half day on this, and the conclusion so far is:

https://github.com/dop251/goja

• maintained and they merge community PRs
• no Go module support (or any dep management whatsoever, PR filed: Add Go modules dop251/goja#189 add go module support dop251/goja#107)
• no protection against stack overflows when exporting nested objects with circular reference (PR filed: Add ExportDepth() to limit depth of nested fields dop251/goja#188)
• memory limit (limit resource usage dop251/goja#6)

https://github.com/robertkrimen/otto

• unmaintained for a long time
• new problems with Go 1.15
• relies on a fork to protect against stack overflows when exporting nested objects with circular references
• supports memory allocation limit

---

So, this neither are ideal. I would still opt to switch to goja because it is maintained and faster than otto.

I'm afraid we need to pick either to keep the builds simple for the open source distribution.