Call Goal if it complies with the sandboxing rules. Before
calling Goal, it performs expand_goal/2, followed by
safe_goal/1. Expanding is done explicitly because situations in
which safe_call/1 typically concern goals that are not known at
compile time.