Selectively short-circuit rendering instead of always doing so when requires are detected [SEC-1323] [INS-4963]

[godfrzero]

This PR builds on top of #8358 to allow certain inbuilt modules to be required. We probably only need to merge this if we discover there are folks using specific modules and we're unable to provide an acceptable workaround once requires are restricted. A few other things to consider:

• Is it possible for the input string to be complex enough to cause a ReDoS?
• We should have test cases to specifically cover scenarios where strings contain no requires, multiple requires, or a mix of allowed and disallowed requires.