[filiphr]

Related to #4314

The JUEL script engine registered the lang:import function whenever there was no SecurityManager, which is always the case on current JVMs. That function loads any class by name and exposes all its public static methods to the script.

lang:import is now only registered when it is explicitly enabled on the factory. Anyone relying on it can register a configured factory, which takes precedence over the one discovered through META-INF/services:

JuelScriptEngineFactory factory = new JuelScriptEngineFactory();
factory.setImportFunctionEnabled(true);
jsr223FlowableScriptEngine.addScriptEngineFactory(factory);

The second part makes script output configurable. The JUEL out:print function used to always write to System.out. It now writes to the writer of the JSR-223 ScriptContext, like Groovy's println and JavaScript's print already do. EL functions have to be static methods, so the current script context is kept in a ThreadLocal during evaluation.

JSR223FlowableScriptEngine#setScriptOutputWriter sets the writer used for the output of all scripts, e.g. Writer.nullWriter() to discard it or a StringWriter to keep it in memory. When it is not set (the default), scripts are evaluated exactly as before.

The same lang:import and out:print changes are applied to the flowable5 compatibility engine.