LPS-50325 Arbitrary code execution

Brian,

This is essentially the same code that use to be in the portal (LPS-14726). However, it was rollback because it was decided that we should use permission to control who can add the XSL Content portlet.

Tomas (@topolik) and I revisited this issue and decided that permission isn't good enough. Even if a user has permission to use the XSL Content portlet, we shouldn't allow the user to execute *any* code they want.

Same issues also applies the web content templates, so it's also fixed here.

~~Also, doing a partial rollback of LPS-49451 since it's not needed after this.~~