Introduce safe mode

Introduce a safe mode flag, which is set via the options on document and *NOT* via a document attribute (for maximum security).

The levels are thoroughly documented in both the Asciidoctor module and the Document class.

- add a safe mode flag to Asciidoctor::Document
- define constants for each safe model level (UNSAFE, SAFE, SECURE, PARANOID)
- document the safe mode levels
- set default safe mode to SECURE_MODE
- replace the use of the safe-paths attribute with safe mode >= SAFE_MODE
- tests

I wasn't sure whether to use simple integer values or a bitwise comparison approach like PHP error levels. For now, I went with values that are spaced out to allow for intermediate values as we uncover new needs.

Atm, the include::[] macro does not support the behavior permitted in UNSAFE_MODE (only SAFE_MODE and greater) because it doesn't use the method from AbstractNode. However, I plan to move the include::[] logic into the Lexer (where it can be handled contextually), at which point I'll align that logic. For now, erring on the side of too secure is A GOOD THING(TM) :) *The include::[] macro is disabled in the default mode (SECURE_MODE) anyway.*