To execute CPS-transformed code through sandbox interceptor, those two needs to collaborate.

The custom invoker makes sure that CPS interpreter doesn't call into Groovy methods directly, and instead goes through sandbox checker
Fixed loose-ends in script security integration

- everything defined in user script is OK to invoke, which means we need to keep track of the classloader used to load them
- new CpsThread created via body invoaction of a step needs to execute in the sandbox mode
Using a method that's more likely rejected.

Object.toString() might get approved out of the box because it sounds benign
Relying on a released version