This commit fixes a Remote Code Execution (RCE) reported by
npm-security. Access to non-enumerable "constructor"-properties
is now prohibited by the compiled template-code, because this
the first step on the way to creating and execution arbitrary
JavaScript code.
The vulnerability affects systems where an attacker is allowed to
inject templates into the Handlebars setup.
Further details of the attack may be disclosed by npm-security.

Closes #1267
Closes #1495

Related to #1497

The test is a simple addition to the existing tests. It should ensure
that the built Handlebars artifact only uses language features that are
available in old versions of NodeJS. A simple program and the
precompiler are started with NodeJS 0.10 to 11

The main reason is that neo-async takes a lot less space due to the missing lodash-dependency.
The other is speed.

closes #1431

Use `neo-async` instead of `async

This reverts commit b2e2cfe.

see #1499

deprecate substr method and use existing strip function in grammar

Internet Explorer does not support the 'class Testclass {}' notation,
and tests are not compiled using babel.

closes #1497

Fix Saucelabs tests