fix(module_loader): respect read permissions for diagnostics

[nathanwhit]

Summary

• require an existing read grant before diagnostic callbacks open local source map or mapped source files
• consult prepared graphs, in-memory cache entries, and standalone VFS contents before falling back to the host filesystem
• carry main and worker permission containers into standalone diagnostic source loading
• omit unavailable diagnostic source text without prompting

Tests

• ./tools/format.js
• cargo check -p deno
• cargo build -p deno --bin deno
• cargo test -p deno --lib module_loader::tests::test_graph_has_diagnostic_source_in_node_modules -- --exact
• ./target/debug/deno test -A --config tests/config/deno.json tests/unit/error_stack_test.ts
• ./x test-spec sourcemap
• ./x test-spec maybe_cjs_source_map
• ./x test-spec diagnostic_source_files