Disallow non-Closure arrow functions

[brandonkelly]

Adds a new enableTwigSandbox config setting, which when enabled, configures Twig with the Sandbox extension with a custom security policy that doesn’t block any tags, filers, methods, or properties. However by simply being enabled, Twig will block all non-Closure arrow functions, fixing several security issues.

{# no longer works #}
{% set names = names|map('ucfirst') %}

{# do this instead #}
{% set names = names|map(n => n|capitalize) %}

The config setting is false by default in core, but will be enabled by default for new craftcms/craft-based projects.

Support for calling non-Closure arrow functions is deprecated and will be removed in a future version of Twig, so updating templates and enabling the setting should be encouraged.