FFI Escape Control

Mainly a release to fix the CI builds, but we have one new feature; the compile-time interpreter will now refuse to call out to external functions via FFI by default, unless --ffi-escape is passed on the command line.

This is kinda similar to --shell-escape used in LaTeX.