reintroduce curated sprig allow list

Reintroduce curated function allow list, that was reverted in #14586.

It should include a guide for translating the sane sprig calls into acceptable expressions.

We should probably call this a breaking release and release it as part of 4.0.

Start by reviewing the reverted change in #14586 and locating the current Sprig integration. The issue names no files or tests, so first determine where the allow list and expression handling live; done means restoring a curated list, documenting acceptable translations, and deciding how the breaking 4.0 release should be handled.

Written by the indexing model from the issue text.