Site might phish a site that archives it

I've been designing as if we could have a page like https://web.archive.org/web/20200914192731/https://www.example.com/ serve a web bundle that it doesn't do a lot of work to vet because it winds up executing in a suborigin. However, @wycats pointed out that that could allow https://web.archive.org/web/20200914192731/https://attack.web.archive.evil.example/ to show a login form for https://web.archive.org, and because the browser would emphasize the serving origin, it would probably fool the user. See also some discussion on #560.

A couple thoughts:

• This is still better than the current situation, where an unvalidated archived site can just exfiltrate login cookies.
• Some discussion in #576 suggests a way to mark a bundle as having no network access, which might prevent it from using any credentials it manages to phish. Is that sufficient?
• This probably isn't a worry for bundles accessed as file:s?

Start with the issue’s archived-URL phishing scenario and read the linked bundle-urls-and-origins.md explainer. Review the related discussions in #560 and #576, including the proposed no-network-access bundle behavior. Done means reaching and documenting a clear security decision about whether the proposed origin and network protections prevent credential phishing.