Prevent certain Lua modules/functions from loading

[program--]

This PR resolves #630.

Changes:

• Modified lua.NewState() call to open only the following modules:
  • base*
  • table
  • math
  • string
  • os*

  * Only opens base.tonumber(), base.tostring(), os.clock(), and os.difftime().

• Vendored internal Lua function implementations for the subset functions from gopher-lua (required to open the subsets, otherwise entire module is available).
• Added scripts_VULN_tests into tests/scripts_test.go; tests for function existence.

All tests pass using go version 1.19.3 on Linux.

[program--]

@tidwall Do you have a preference between using nested functions versus the current function definitions I've added? (i.e. osClock, osDiffTime, etc.)

I noticed in lStatePool.New() that you implement some Lua package module functions, but nest the function definitions within .New().

I could move the definitions directly into openOsSubset and openBaseSubset so they don't pollute the internal namespace, but I guess that's more of a style choice than anything else.

[tidwall]

I could move the definitions directly into openOsSubset and openBaseSubset so they don't pollute the internal namespace, but I guess that's more of a style choice than anything else.

I'm fine with your approach.

[tidwall]

LGTM. Thanks 👍