Function HardenNunjucksRuntime

Guards the nunjucks parser, code generator and runtime used by every nunjucks environment in this process. After this call:

• a template whose names could change the compiled code fails to compile (see AssertTemplateTreeIsSafe)
• a macro or call-block argument that a call leaves out is filled only from a keyword argument that the call itself passes under that name, never from a member the keyword arguments inherit, so otherwise it reads as empty
• keyword arguments written at a call site must be an ordinary object literal: ones that inherit from anything but Object.prototype, or that use a name that every object inherits (or prototype), throw, and the code generator refuses such a name as a dictionary key or keyword argument too; keyword arguments passed as a value (from render data, for example) are read through a copy of their own keys
• a filter, test or global resolves only to a name the environment registered itself, never to a member that every object inherits (such as hasOwnProperty); an object, a function or a symbol is refused as the name
• a member named constructor, prototype, __proto__ or one of the __define/lookup Getter/Setter__ accessors, written literally or computed while rendering, reads as undefined, unless it is an object's own data that is not a function; __proto__ always reads as undefined
• a bare name resolves only to a template variable, an own key of the render data, or an own environment global, never to a property that the render data or the globals inherit
• a template may not read a member of the render context, an environment, a loader, a frame, a template or a nunjucks module, and a lookup or call that would return one of them throws
• a lookup or call that would produce or use Function (or its async and generator variants), eval, Object, Reflect, globalThis or process throws a TemplateSandboxError

Safe to call any number of times: a hook that already carries the guard is left as it is.