ESM imports escape the sandbox & runfiles

The relevent code in node is in resolve.js where there is a realPathSync call

https://github.com/nodejs/node/blob/4c5b96b376aa778cbe651362c29a26e0d4c32ccd/lib/internal/modules/esm/resolve.js#L310

This realPathSycn call does not get the fs monkey paches while the cjs require loader's realPathSync call does. It is unclear why.

This is the underlying reason why we current need `--preserve-symlinks-main` on by default in js_library so the `.mjs` entry points don't escape their runfiles.

It is also the reason mocha was observed to escape the sandbox in the repro https://github.com/aspect-build/rules_js/pull/353#issuecomment-1206659854 and likely related to https://github.com/aspect-build/rules_js/issues/347.

This affects `.mjs` entry points and programs that use esm imports. For example, mocha uses the `import()` built-in that is affected.