Enhance invoker, add tests, enforce security

Second review of CLI code. I'm happy with it at this point.

The only open questions I have is whether we should be checking whether the input file exists in Options and whether you like Options returning an error code when parsing fails (got a better way?)

Look it over, see what you think.

Here's a summary of what's changed:

- provide access to document after invoker runs for testing
- add stream redirection to invoker
- add exit code to invoker rather than using a hard exit
- check that input file exists in options
- set outfile on document after rendering for access in tests
- add support for stdin
- fix doc info attribute assignments, only set when input is a file
- clarify the purpose of base_dir and docdir, respectively
- use base_dir in normalize_asset_path
- don't allow document to emit docdir or absolute docfile in secure mode
- don't allow document to change doctype in secure mode
- cleanup the option descriptions
- add a --safe flag which is compatible with asciidoc
- take out rubygems require (that should be handled by rubygems)
- fix incorrect minute field in time format
- loads of invoker tests
- test for input file with spaces
- additional helper methods for testing invoker
- rename option_tests.rb to options_test.rb
- add timings to cli
- fix bug of not carrying over safe level in nested document