Prevent access to Java classes from JS

[plata]

All functionality used in Javascript shall be implemented as a Bean such that we have a well defined API.

[madoar]

Examples:

• ProcessBuilder
• Filesystem access

[plata]

@qparis do you know how this white listing could be done? For our API we have @Safe but what about the normal Java classes.

[qparis]

Maybe Context#allowHostClassLookup

[plata]

Could you do a proof of concept (for me it's not quite clear currently)?

[qparis]

See PR #2018