Add script_groovy_sandbox_receiver_whitelist param to ES template

For SEARCH-2267: Use groovy instead of mvel for ES scripts
"Comma-separated list of string classes for objects that may have methods invoked."

What does this list actually mean? Is any code disallowed if you include Object in the list?