Avoid using function constructor for alt format handling

This allows rbush to be used where the Content Security Policy (or other) disallows the use of eval and related functions (e.g. browser extensions).  Previously, the format supplied could contain function calls (e.g. `['.getMaxX()', ...]`).  With this change, only property names are accepted - though they can be dot prefixed or bracket wrapped (e.g. `'.maxX'` or `'[0]'`).