Patching serverside script injection

Nunjucks currently has the ability to execute code in serverside Node.js context.

```
{{ a.constructor.__proto__.constructor('process.kill()')() }}
```

This PR will make the runtime skip self invoking constructors created inside Nunjucks templates.

https://github.com/mozilla/nunjucks-docs/issues/17