fix: ban import assertions during publishing

[lucacasonato]

Only import attributes are allowed now.

Technically this also bans import "./deno.json" /* assert */ with { type: "json" }; but hey, who cares?! :D

Fixes #418

[marvinhagemeister]

What about dynamic assertions like:

await import('./foo.json', { assert: { type: 'json' }});

Looking at the PR I think these are still allowed.

[lucacasonato]

It is a lot of effort to implement this for dynamic import, and considering that users already need to assume that dynamic import may fail, and also we can not analyze all cases (for example user passes the options bag via a binding).

Also if we did ban this, there would be no way to write code that works both with systems that do and do not understand attributes yet (for example await import("./data.json", { assert: { type: "json" }, with: { type: "json" }) works in a larger number of Node versions than just with: { type: "json" }.

[marvinhagemeister]

Makes sense, didn't know that the dynamic variant shared wider support in Node. In that case I'm fine with landing this.