Security issue with CC.checkpoint

[cpcallen]

CC.checkpoint passes its arguments unmodified to CodeCity.checkpoint. Passing a truthy first argument will cause the interpreter to be paused and never restarted, effectively wedging it.

The other builtins defined in CodeCity.initSystemFunctions should be checked for similar issues.