refactor: Move REPL query safety check into runner

[rschristian]

I've been linking to a few REPL examples over the past few days, and one thing that's slightly bothering me is that we show the confirmation/warning for running untrusted code before showing the code itself. The user has to gauge whether they trust whoever provided the link rather than if they trust the code (or copy the query into a base64 decoder and read that, I suppose).

This isn't perfect (see the TODO: I left behind), but it moves the confirmation check further ahead into the REPL runner itself. This lets the user (partially) see the code populated in the editor pane before they're forced to accept or refuse.

Before	After