Add an enforced security policy execution path

[vndee]

Context

The security guide documents that SecurityPolicy is advisory and must be checked manually with session.is_safe(code). run() executes code without enforcing the configured policy.

Why this matters

The manual check-then-run pattern is easy for users and integrations to forget. For a sandboxing library, there should be a first-class enforced path that blocks execution when policy violations meet the threshold.

Acceptance criteria

• Add an opt-in API such as enforce_security_policy=True or safe_run().
• Return or raise a structured error containing the policy violations when execution is blocked.
• Keep existing advisory behavior backward compatible unless a major-version change is planned.
• Add tests covering safe code, blocked code, severity thresholds, and restricted modules.
• Update docs to recommend the enforced path for production.