Improve template evaluation security to prevent arbitrary code execution

[NiklasRosenstein]

Currently, Nyl uses structured-templates to evaluate ${{ ... }} expressions in Kubernetes manifests. This package currently uses eval() to evaluate these expressions, which is insecure when evaluating untrusted Kubernetes manifests, such as in a multi-tenant deployment of ArgoCD.

https://github.com/NiklasRosenstein/python-structured-templates/blob/88cb31e7c560fe63269b5f81f50dcc77bbe6c559/src/structured_templates/engine.py#L163-L172

An attacker could add this into a Kubernetes manifest to read out the SOPS_AGE_KEY environment variable for example:

apiVersion: v1
kind: Secret
metadata:
  name: expose-it
stringData:
  SOPS_AGE_KEY: ${{ __import__("os").getenv("SOPS_AGE_KEY") }}

We must replace it with a more secure engine that supports the same simple language constructs (e.g. attribute lookup and function calls) but severely limits the scope of the operations that can be performed inside a template expression.