[drgrice1]

The _clean_stash method deletes the DESTROY, AUTOLOAD, and overload methods defined by compartment code after it runs, so that the code is not executed outside the safe compartment (for example when an object is destroyed), where it would run with the main:: symbol table and could reach privileged subroutines by name. It skipped the shared packages that are aliased into the compartment via share_from (such as the MathObjects Value:: tree), since deleting a hook from one of those would corrupt the package. But that left a problem or macro free to define a hook under a shared namespace (for example a DESTROY method in a new Value::Evil package, or by overwriting an existing overload such as Complex1::(+ in place), and that hook survived the cleanup.

To close this, snapshot_hooks now records the hooks that in shared packages, once the compartment is fully set up but before any problem or macro code runs. _clean_stash then uses that cache to restore any shared hook that problem or macro code overwrote, and strip all hooks that problem or macro code added. So hooks in packages defined inside the safe compartment are stripped as before, but also hooks that are defined inside the safe compartment using basename of the namespace of a shared package are stripped (so Value::Evil is stripped, but not Value::Real).

To keep this cheap, overwritten hooks are found by walking the recorded baseline hook list, and added hooks are looked for only in the shared packages whose key count changed since the baseline, so the (static) shared packages that problem code did not touch are not re-walked. The baseline is recorded at the end of the compartment setup (in the BEGIN block when rendering in a Mojolicious app, and at the end of unrestricted_load otherwise).

This also updates some out of date comments that described the cached safe compartment as being for the "standalone renderer". In general it is used whenever rendering in a Mojolicious app, which now includes webwork2.