(core) support python3 in grist-core, and running engine via docker and/or gvisor

Summary:
 * Moves essential plugins to grist-core, so that basic imports (e.g. csv) work.
 * Adds support for a `GRIST_SANDBOX_FLAVOR` flag that can systematically override how the data engine is run.
   - `GRIST_SANDBOX_FLAVOR=pynbox` is "classic" nacl-based sandbox.
   - `GRIST_SANDBOX_FLAVOR=docker` runs engines in individual docker containers. It requires an image specified in `sandbox/docker` (alternative images can be named with `GRIST_SANDBOX` flag - need to contain python and engine requirements). It is a simple reference implementation for sandboxing.
   - `GRIST_SANDBOX_FLAVOR=unsandboxed` runs whatever local version of python is specified by a `GRIST_SANDBOX` flag directly, with no sandboxing. Engine requirements must be installed, so an absolute path to a python executable in a virtualenv is easiest to manage.
   - `GRIST_SANDBOX_FLAVOR=gvisor` runs the data engine via gvisor's runsc. Experimental, with implementation not included in grist-core. Since gvisor runs on Linux only, this flavor supports wrapping the sandboxes in a single shared docker container.
 * Tweaks some recent express query parameter code to work in grist-core, which has a slightly different version of express (smoke test doesn't catch this since in Jenkins core is built within a workspace that has node_modules, and wires get crossed - in a dev environment the problem on master can be seen by doing `buildtools/build_core.sh /tmp/any_path_outside_grist`).

The new sandbox options do not have tests yet, nor does this they change the behavior of grist servers today. They are there to clean up and consolidate a collection of patches I've been using that were getting cumbersome, and make it easier to run experiments.

I haven't looked closely at imports beyond core.

Test Plan: tested manually against regular grist and grist-core, including imports

Reviewers: alexmojaki, dsagal

Reviewed By: alexmojaki

Differential Revision: https://phab.getgrist.com/D2942

sandbox/docker/Dockerfile

@@ -0,0 +1,14 @@
+FROM python:3.9
+
+COPY requirements3.txt /tmp/requirements3.txt
+
+RUN \
+  pip3 install -r /tmp/requirements3.txt
+
+RUN \
+  apt-get update && \
+  apt-get install -y faketime
+
+RUN useradd --shell /bin/bash sandbox
+USER sandbox
+WORKDIR /

sandbox/docker/Makefile

@@ -0,0 +1,3 @@
+image:
+	cp ../requirements3.txt .  # docker build requires files to be present.
+	docker build -t grist-docker-sandbox .

sandbox/requirements.txt

@@ -7,6 +7,7 @@ html5lib==0.999999999
 iso8601==0.1.12
 json_table_schema==0.2.1
 lazy_object_proxy==1.6.0
+lxml==4.6.3                # used in csv plugin only?
 messytables==0.15.2
 python_dateutil==2.6.0
 python_magic==0.4.12

sandbox/requirements3.txt

@@ -0,0 +1,21 @@
+astroid==2.5.7  # this is a difference between python 2 and 3, everything else is same
+asttokens==2.0.5
+backports.functools-lru-cache==1.6.4
+chardet==2.3.0
+enum34==1.1.10
+html5lib==0.999999999
+iso8601==0.1.12
+json_table_schema==0.2.1
+lazy_object_proxy==1.6.0
+lxml==4.6.3                # used in csv plugin only?
+messytables==0.15.2
+python_dateutil==2.6.0
+python_magic==0.4.12
+roman==2.0.0
+singledispatch==3.6.2
+six==1.16.0
+sortedcontainers==1.5.7
+webencodings==0.5
+wrapt==1.12.1
+xlrd==1.2.0
+unittest-xml-reporting==2.0.0