There are some nice non-JIT embedded languages such as Angelscript (resembles C++, uses refcounting instead of GC), Squirrel (extension of Lua syntax to support classes and other nice features), and recently Wren (has a nice class system and uses fibers for concurrency).

Does Apple still prohibit any form of downloaded code or scripting or did they finally ease that?

They do if the user can download and execute the code themselves. If the underlying app uses it (e.g. React Native app downloads updated bundle) and user can't touch it then it's okay.

Wren looks interesting. It stands out by the lack of use of setjmp/longjmp for error handling. It's probably side effect of being able to return/suspend fiber from any call stack depth.

Haxe is the leader there, besides swift.