Switch foreach to use tmpl_copy_vp

We have to fudge the config parser a bit to convert &attrref -> &attrref[*] but it works, and the code is quite a bit nicer.