Root code execution via unsandboxed Jinja2 templates

Code injection in Mock allows local users who control configuration tags to execute arbitrary code with root privileges. TemplatedDictionary.__render_string() passed those tag values to jinja2.Template and rendered them with the full configuration dictionary instead of a sandbox. Exploitation requires control of Mock configuration tags, which some build services delegate to less-privileged authenticated users, and yields root execution on the build server.