fix($parse): disallow access to Function constructor

Sandboxing Angular Expressions
------------------------------
Angular expressions are generally considered safe because these
expressions only have direct access to $scope and locals.  However, one
can obtain the ability to execute arbitrary JS code by obtaining a
reference to native JS functions such as the Function constructor.

As an example, consider the following Angular expression:

  {}.toString.constructor(alert("evil JS code"))

We want to prevent this type of access.  For the sake of performance, we
disallow any access to any member named "constructor".  You can foil
this by sticking in the Function constructor under a different name in
your scope or exposing other JS apis or the DOM by sticking it on the
scope.  Don't do that - you increase the chances of accidently allowing
an exploit through.