The challenge is, I am not aware of any methods to grant all-powerful permissions while preserving the security of the page and/or server.

You would almost need to link to a sandboxed server within an iFrame, such that it could be refreshed and/or cleaned automatically. This would allow what's 'in the box' to get completely hacked beyond all recognition, then easily wiped clean.

Overall, the model of a forum, such as this, allows anyone to do what you're thinking about--sort of. But working code lets anyone completely and totally own the server, plus implement all types of attacks against any site visitor.

Are these trusted users or users on the Internet? Would they be logged in as a user or not?

The issue is that a malicious person can write a script that infects any page visitor with some horrendous malware, plus being able to post working code really breaks all security of the web app and server and could easily crash it.

Now if they are logged in, that's a different issue....then they are...using a CMS.

Instead of trying to achieve this at the block level, consider doing it at the page template level.

It's possible to dynamically change the editable areas on a page, using page attributes to control them.

I wrote about a technique like this here:
http://www.mesuva.com.au/blog/concrete5/adding-content-to-alternati...