Is there a way to block browser JavaScript from executing commands that retrieve sensitive information from my local machine, while still allowing JavaScript that is only used for rendering web pages?

Browser JavaScript is already sandboxed, so there is a limit to the info that can be accessed, though it does expose some of basic information you've listed.

To the best of my knowledge, the only items that can be accessed from the ones you listed are:

• current time (by creating a Date object)
• operating system and version (though this is usually not precise info and only provides a rough version)

an example of the info that can be accessed (via the navigator property) for a Windows pc is:

# platform = Win32
# appCodeName = Mozilla
# appName = Netscape
# appVersion = 5.0 (Windows; en-US)
# language = en-US
# mimeTypes = [object MimeTypeArray]
# oscpu = Windows NT 5.1
# vendor = Firefox
# vendorSub = 1.0.7
# product = Gecko
# productSub = 20050915
# plugins = [object PluginArray]
# userAgent = Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7

As you can see it's not a whole lot of information. Certainly there is no way to get the serial number or other hardware information. Also, local files cannot be accessed without permission.

There are some user agent spoofer addons that will change the user agent string. I am not sure but i imagine some of those also allow overriding this navigator information to anonymize that data further. Preventing accessing the user's time zone would be pretty impossible though given how the Date object works.

I've been using JShelter which provides a few different options for handling page load failures. It also works on Firefox mobile.

A couple notes:

• You can be fingerprinted by the extensions you have installed in your browser. This is really difficult to circumvent, because if certain pieces of a website's code never load on your system and never send expected responses to the server then the server definitely knows that. The more uncommon extensions you have installed, the more identifiable you are - and you're already in a minority as a Firefox user.
• More and more websites are behind Cloudflare (mostly because of DDoS attacks) and JShelter will typically break Cloudflare's filter which attempts to block bots. I've found that disabling just the fingerprint detector usually allows access to sites that have this protection.

local machine time

local machine ram

I'd venture the only way to block those is to either recompile the browser or somehow use a separate Javascript engine that doesn't provide that info, as it's pretty foundational (as some people mention, localtime is accessible simply by constructing a Date object).

The Tor Browser and Firefox's Resist Fingerprinting mode hide some of the things that can be used to identify your system, but there is no way to hide them all. Short of avoiding all sites that you don't completely trust, disabling scripts is the best protection available.

multiple scripts running on different domains

Off-site scripts can be blocked on a per-site basis with browser extensions like uMatrix (discontinued by still functional) and uBlock Origin (still maintained but harder to use for this purpose). To be clear, these scripts run on your machine, regardless of where they come from.