Compile-time transformer to run Groovy code in a restrictive sandbox