Use RestrictedPython to load modules instead of sandboxed code
Something I hadn't bothered to do a while ago because it's not the most performance-sensitive, but removing the loading interface will simplify the changes required for !529 (merged).
This makes modules a little more strict, since describe_*_options
and describe_*_parameters
now have the same limitations as global scope code in pybuilds.