xblock-external-ui: Add XBlock API call to render XBlock views

@cpennington @nedbat @ormsbee Can you have a quick look to check that I'm on the right path with this? It seem to work well, rendering either individual blocks or verticals containing both XBlocks and XModules. If that's the correct approach, I'll flesh it out more, add tests and start working on the client side, but I could use a sanity check : ) Thanks!
True. It would be a vulnerability if this were available over JSONP, but since it's just vanilla JSON it should be fine.