xblock-external-ui: Add XBlock API call to render XBlock views

@cpennington @nedbat @ormsbee Can you have a quick look to check that I'm on the right path with this? It seem to work well, rendering either individual blocks or verticals containing both XBlocks and XModules. If that's the correct approach, I'll flesh it out more, add tests and start working on the client side, but I could use a sanity check : ) Thanks!
`is_secure()` is what triggers the additional CSRF middleware checks on the referrer: https://github.com/django/django/blob/b91c385e324f1cb94d20e2ad146372c259d51d3b/django/middleware/csrf.py#L117

Switching it to `False` allows to skip these additional tests when running the standard CSRF middleware, and do them here instead.