Use RestrictedPython to load modules instead of sandboxed code

Something I hadn't bothered to do a while ago because it's not the most performance-sensitive, but removing the loading interface will simplify the changes required for !529 (merged).

This makes modules a little more strict, since describe_*_options and describe_*_parameters now have the same limitations as global scope code in pybuilds.