introduce safe mode

- add a safe mode flag to Asciidoctor::Document
- define constants for each safe model level (UNSAFE, SAFE, SECURE, PARANOID)
- document the safe mode levels
- set default safe mode to SECURE_MODE
- replace the use of the safe-paths attribute with safe mode >= SAFE_MODE
- tests