Untrusted Methods

After one allows method via `allow` or `require`:
```xml
<class class="ProtectedClass">
  <allow attributes="method" />
</class>
```
`self` is unprotected (unwrapped) inside `method`.

The approach allows passing proxy object inside method not to trust its code.

C implementation is missing, and is yet TBD.

We'd like to get initial feedback on the approach and other options to achieve the **Untrusted Methods** goal.