fix($parse): disallow access to Function constructor

Sandboxing Angular Expressions
------------------------------
Angular expressions are generally considered safe because these
expressions only have direct access to $scope and locals.  However, one
can obtain the ability to execute arbitrary JS code by obtaining a
reference to native JS functions such as the Function constructor.

As an example, consider the following Angular expression:

  {}.toString.constructor(alert("evil JS code"))

We want to prevent this type of access.  We do this by disallowing
access to native functions.  It's not easy to distinguish a native
function from a user defined function - especially since iframe and such
contexts have an independant copy of Object.  So we check to see if a
function, func, satisfies the condition "func.constructor == func".
Native functions satisfy this test while the typical user defined
function doesn't.  This provides a good balance between allowing most
accesses while disallowing unsafe ones.