Put template rendering in a jail

Work in progress (not passing all tests yet) move to a `TemplateContext` class to sandbox template rendering.

Pretty happy with most of this. Some things still aren't working, such as partials, `wrap_layout` and template instance variables. The first two make sense, we took all their shared global state away and now they don't know what the hell is going on. I'll figure out how to deal with that.

However... what should be do about template instance variables? Seems like something that v4 would be a good time to remove support for. Are there things you can do with instance vars that you couldn't with locals?