Load Apps Sandboxed

An attempt at #2007

- Based on suggestions from ~~@gotdibbs, loading with an eval approach~~ @hswolff to use native Module class.
- Load relative modules in child sandboxes

~~This gets a little hairy because of things like __dirname getting set to the core/server/apps path when we `eval`, but it's a decent start after some hackery.  I feel like the test cases give some faithful things a person might try and be sneaky about.~~

I know @sebgie mentioned a more white list than black list approach, but I wasn't sure how to do that.  Feedback welcome.