xblock-external-ui: Add XBlock API call to render XBlock views

@cpennington @nedbat @ormsbee Can you have a quick look to check that I'm on the right path with this? It seem to work well, rendering either individual blocks or verticals containing both XBlocks and XModules. If that's the correct approach, I'll flesh it out more, add tests and start working on the client side, but I could use a sanity check : ) Thanks!
What would be the attack scenario? This is similar to including a CSRF token in an HTML form. The attacker on a third-party site wouldn't get access to the content of the answer and the CSRF token value it contains unless the domain is explicitly allowed in the CORS configuration.