Privilege escalation (PR) from account through AdminTemplatesSheet

Steps to Reproduce:

1. Set the title of any document you can edit (can be the user profile) to

   {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}

2. Use the object editor to add an object of type XWiki.TemplateProviderClass (named "Template Provider Class") to that document.
3. Go to another document you can view (can be the home page) and append ?sheet=XWiki.AdminTemplatesSheet to the URL.

Expected result:

A template

{{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}

is displayed in the list of templates.

Actual result:

A template Hello from groovy! is displayed, showing that the Groovy code has been executed. This demonstrates a privilege escalation from account to programming rights.