Privilege escalation via properties with wiki syntax that are executed with the wrong author

Steps to reproduce:

1. As an admin with programming rights, create a new user without script or programming right.
2. Login with the freshly created user.
3. Insert the following text in source mode in the about section:

   {{groovy}}println("hello from groovy!"){{/groovy}}

4. Click "Save & View"

Expected result:

An error is displayed in the about section that the script macro couldn't be executed.

Actual result:

The text "hello from groovy!" is displayed.

This works with any TextAreaClass property that has wiki syntax enabled and is displayed using the regular displayer, e.g., using $doc.display in a document where the content author is a user with programming right. The reason seems to be that `TextAreaClass` overrides the security document which is explicitly set by $doc.display to ensure that not the content author but the displayed object's author is used.