It used to be that the realm/context created with the isolate was sometimes called "global context" and sometimes "main context/realm". This goes back to the days before JsRealm, when the JsRuntime::global_context method returned a v8::Global for the only v8::Context that existed in the isolate. Nowadays that is no longer the case, and we should call it the main realm.

That change by itself would also rename some properties/variables from is_global to is_main, which is also used elsewhere to refer to the top-level JsRuntime/isolate in a process. Therefore, the names are changed to is_main_runtime and is_main_realm to disambiguate.

- extract_tarball_gz: skip symlink/hardlink tar entries (path-traversal via a
  symlink to an outside dir + a file nested under it, on arbitrary registry/@jsr
  content).
- Rebase the user's compilerOptions.paths + baseUrl onto .deno/ (the generated
  tsconfig lives one level down); they were copied verbatim, so `~/*`->`./src/*`
  resolved to .deno/src/* and broke every import through a user alias. Dropped
  paths/baseUrl from passthrough; added rebase_onto_deno_dir + test.
- sync_types_command: check node_modules/.deno components on the path RELATIVE to
  the project root, so an ancestor dir named node_modules/.deno no longer filters
  every root away (empty graph, no error).
- ensure_root_tsconfig: edit the existing tsconfig by byte-range splice via the
  jsonc AST instead of re-serializing, preserving the user's comments and
  formatting (previously silently stripped on the first sync).
- strip_top_level_type_decls: bound the leading-comment back-pop to contiguous
  comment lines (an unbounded 'pop until /**' could delete earlier decls), and
  make the type-alias skip track bracket depth so an interior ';' doesn't end it
  early.

Deferred (noted on the PR): resolution flags incl --allow-import (#3),
skipped-remote policy (#4), import-map scopes (#8), @types/node via #35889 (#10).