[SECURITY-86] don't let user set arbitrary groovy code to run on master without RUN_SCRIPT permission