Make properties slightly less generic, fix security risk

It was possible to do things like "/ex narrate
<p@name[velocity=0,10,0,world]>" to launch yourself in the air, or apply
any other mechanisms to anything else very easily through just a tag...
a tag should never execute code with a visible effect, on the off chance
a poorly written script accidentally exposes free tag-writing to common
players.
This will now only allow tags to apply property/mechanisms if the object
is not in the world (EG, an un-spawned entity, or an item)
NOTE: Inventories are still at-risk, as their data is entirely in props
for some weird reason, and could potentially be used to add items to
an existent inventory or something like that.