[Security] Arbitrary Code Injection

[FahidLatheef]

https://security.snyk.io/vuln/SNYK-PYTHON-PYCEL-10050519

This causes lot of CVE tools to mark pycel as dangerous. Maybe better sanitization is required to escape this issue.

[leo3065]

I plan to work on this, I think doing both of the following can solve this issue:

• For the parts about tokenizing and parsing the formulas to turn them into ASTs, add a check that only allows provided list of functions
• In build_eval_context, limit the elements in the namespace to prevent the eval being run

[stephenrauch]

@FahidLatheef - That approach does not sound unreasonable, if it can be made optional for those not at risk, or the runtime penalty is neglible.