Consider making `Zone.ROOT` private.

[lrhn]

If the only zones code has access to is Zone.current and any zone it was given access to (e.g., by creating a new one), then zone encapsulation is total. Code can ensure that a function runs entirely inside a specific zone by just using zone.run of that zone.

With access to Zone.ROOT, any code can escape the zone it was supposed to run in. While this is an escape hatch, it also makes it impossible for framework code to properly encapsulate foreign code, and a test framework can't properly test code that uses Zone.ROOT for anything.

Same thing goes for Zone.errorZone. The only necessary functionality is bool Zone.isSameErrorZone(Zone other). (We should still be careful about which arguments that function is called with).

[lrhn]

An alternative, which is non-breaking, is to allow zones to mark themselves as root zones, and while inside such a zone, Zone.root would refer to the nearest enclosing root zone, not the root-root zone.
Since there are no such root zones now, introducing the feature should not break anything.