Page-editor command execution via unchecked callable

Code injection in Blueprint::dynamicData() in Grav before 2.0.7 allows remote authenticated users to execute OS commands via page frontmatter. The method passes an editor-controlled Class::method provider and its arguments to call_user_func_array() with no allowlist, and Grav\Common\Utils::arrayFilterRecursive() can then invoke system on attacker-supplied input. An account with admin.pages or api.pages.write is required to plant the payload, but any later view of the page, including by an unauthenticated visitor, triggers execution as the web server user.