[forth] add test ruling out eager expansion of custom arguments.

[coriolinus]

Closes #1221.

Implements the approach suggested in that issue.

[coriolinus]

Note that the current example solution suffers from the attack this PR is meant to ban. This means that we need to update the example.

I'd ideally use a student solution which is both compact and readable, but I'm not happy with the ethics of just grabbing it without permission, even with attribution. I think that approach is only viable if the student approves, and I don't have a good way to contact them. I don't think that mentor notes are the appropriate venue for such a request.

I'm happy to contribute my own solution, but that solution has not been reviewed at all and requires an external library. It's very readable (IMO), but I got a little architecture-happy with it.

[iHiD]

We don't need permission. Everything a student uploads is licensed to us to use as we want. That's made very explicit during the signup process.

Once it's done though I can let them know :)

[coriolinus]

Thanks @iHiD, I think they'd appreciate knowing that once this is merged.

[ghost]

Love the added context here!