Add Groovy sandboxing for GString-based method invocation

This forbids things like:

```
obj."${'get' + 'Class'}"()."${'getDeclared' + 'Method'}"("myPrivateMethod")."${'set' + 'Accessible'}"(true)
```