rejectHtmlComments = src => {
  const lineNumber = getLineNumber(src, htmlCommentPattern);
  if (lineNumber < 0) {
    return src;
  }
  const name = getSourceURL(src);
  // See https://github.com/endojs/endo/blob/master/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md
  throw SyntaxError(
    `Possible HTML comment rejected at ${name}:${lineNumber}. (SES_HTML_COMMENT_REJECTED)`,
  );
}
Conservatively reject the source text if it may contain text that some
JavaScript parsers may treat as an html-like comment. To reject without
parsing, `rejectHtmlComments` will also reject some other text as well.

https://www.ecma-international.org/ecma-262/9.0/index.html#sec-html-like-comments
explains that JavaScript parsers may or may not recognize html
comment tokens "<" immediately followed by "!--" and "--"
immediately followed by ">" in non-module source text, and treat
them as a kind of line comment. Since otherwise both of these can
appear in normal JavaScript source code as a sequence of operators,
we have the terrifying possibility of the same source code parsing
one way on one correct JavaScript implementation, and another way
on another.

This shim takes the conservative strategy of just rejecting source
text that contains these strings anywhere. Note that this very
source file is written strangely to avoid mentioning these
character strings explicitly.

We do not write the regexp in a straightforward way, so that an
apparennt html comment does not appear in this file. Thus, we avoid
rejection by the overly eager rejectDangerousSources.

@param {string} src
@returns {string}