[WiP] sandbox execution

groovy-cps 1.1 unblocks the problem that prevents the real meat from getting tested.

As of 1026e48 the code gets rejected during `GString` instantiation that CPS transformer `Builder` class compiles into:  `new StringImpl([v1,v3,v5] as Object[], ["str","str","str"] as String[])`

The operation that fails is the coerced cast operator "as".
Fine for now, but do these need to be whitelisted in `script-security`?