Fix leaking data between TemplateHooks and add sandboxing.

TemplateHooks could easily leak data into the main context when
rendering, overriding variables provided by other contexts. While
TemplateHook tries to push/pop, subclasses can always override and
forget to do so. They can also potentially raise an exception, breaking
the rendering of the page.

To work around all this, we now push/pop in template_hook_point, to
prevent any leakage, and catch exceptions to help sandbox.

Reviewed at https://reviews.reviewboard.org/r/5761/