Run TemplateHaskell with sandboxing

From Luite:

> By the way, GHCJS runs Template Haskell with a JS engine now (it used to load native code) so it's not all that hard to build a variant that is safe enough for untrusted code. The standard implementation is a [small server script](https://github.com/ghcjs/ghcjs/blob/master/lib/etc/thrunner.js) that runs on node.js. GHCJS first sends the runtime system and the actual [Template Haskell runner code](https://github.com/ghcjs/ghcjs-prim/blob/master/GHCJS/Prim/TH/Eval.hs), and then incrementally all compiled splices and their dependencies. You could for example modify the script to use a [node.js sandbox](https://github.com/gf3/sandbox), if you're more adventurous you could even send it to the user's browser.

Start by reading the linked GHCJS lib/etc/thrunner.js script and GHCJS/Prim/TH/Eval.hs runner to understand how Template Haskell code and dependencies are sent to Node.js. Investigate whether the proposed node.js sandbox can safely isolate untrusted code, then verify that Template Haskell still runs while native access is restricted.

由索引模型根据 Issue 内容生成。