Make Execution of Script in SecureContext configurable

[simonholzapfel]

CHECKLIST

We will not consider a PR until the following items are checked off--thank you!

• There aren't existing pull requests attempting to address the issue mentioned here
• Submission developed in a feature branch--not master

CONVINCING DESCRIPTION

This small change makes it configurable whether scripts executed in the JavaScript-Console should run in a secure context or not, with the default configuration not affecting the original behaviour.
This way, for example, the usage of java.* Packages like java.lang.Runtime can be prevented by setting the new property ootbee-support-tools.js-console.scriptContext.secure from the default value true to false.

RELATED INFORMATION

Fixes #

[AFaust]

This config property in the backend can make sense if the system overall should be secured, i.e. even admins should be heavily restricted in what they can do with the JavaScript Console.
My immediate thought was that this could also be a "per-request" parameter in the UI, like the "run like crazy" feature. This would allow an admin to selectively run a script with secure context, i.e. to test if it would work the same way before setting it up as a rule in a secure context. With a UI parameter, we could also use this in the dynamic tern generation to potentially limit the scope of type definitions we expose.

An interesting PR - I had not considered that yet, thanks. I might merge it as-is and potentially set up an issue for the UI parameter as a later enhancement (backend flag would remain with such a later change as a global guard / forced-secure flag)

[simonholzapfel]

Thank you!
For our use case it's essential that this parameter is constant system wide and not overridable on the fly.
This way we can facilitate further debugging on a DEV Stage while preventing the execution of potentially dangerous code on PROD as is required for us.

[AFaust]

Approved in principle - I only ask to consider renaming the configuration property to a more easily understandable one. I'd do the change myself before merging if the PR allowed pushing changes to the branch.