Similar to T197137: Editing sitewide JS/CSS pages should require elevated security and T419152: Editing user JS/CSS pages of another user should require elevated security, maybe we also want reauthentication before a user is able to edit their own JS? This is less clear-cut than the other two but there are scenarios where it would be useful:

• When the user JS in question is used by many others (ideally this wouldn't happen, but it does, a lot; sometimes even site scripts include user scripts).
• When an attacker wants to escalate a temporary account takeover (e.g. reflected XSS) into a permanent one
• Specifically for global.js, an attacker could use it to escalate a Meta account takeover to all other sites.