[Bug][Security] Current `package.path` feels wrong. Shouldn't load modules from CWD.

[MuhammedZakir]

Current Behavior:

When requireing, Luakit loads modules from current working directory.

Desired Behavior:

Shouldn't do that, and should only load from a selected list. Could be in this order:

1. Local config dir (default: $XDG_CONFIG_HOME/luakit/)
2. Global config dir (default: /etc/xdg/luakit/)
3. Luakit module dir (default: /usr/local/share/luakit/)
4. Lua/LuaJIT lib dirs.

How can we reproduce it (step by step):

1. cd /tmp
2. echo 'print "=====WRONG lousy.lua====="' > lousy.lua
3. Run luakit and you can see that wrong lousy.lua is required.

This feels wrong and dangerous.

Environment:

Linux Distribution & Version: Manjaro XFCE (X11) Output of luakit --version:

luakit 2.3
  built with webkit 2.34.6 (installed version: 2.36.3)

[MuhammedZakir]

It looks like there is some safeguard for core modules -- saw this in the log

W [lua/rc]: Found local version /home/user/.config/luakit/search.lua for core module 'search', but it won't be used, unless you update 'package.path' accordingly