Load CSM environment after the restrictions are known

Safety-guards for CSM callbacks to abort on a bad implementation
Only run callbacks when the mods are loaded (and with it: builtin)

Duplication checks inside constructors

src/script/cpp_api/s_security.cpp

@@ -264,6 +264,7 @@ void ScriptApiSecurity::initializeSecurityClient()
 	};
 	static const char *debug_whitelist[] = {
 		"getinfo",
+		"traceback"
 	};
 
 #if USE_LUAJIT