d3.csv: support strict Content-Security-Policy.

This is a workaround for a strict Content-Security-Policy such as:

  Content-Security-Policy: script-src 'self';

This policy prevents new Function(<string>), which we rely upon for a
performance optimisation in d3.dsv.  Fortunately, we can simply check if
an exception is thrown and fall back to the slower implementation.

One minor issue with this fix is that a warning will always be displayed
in the console when this strict policy is in place (even if d3.dsv is
not used).

This could be improved slightly by moving the try/catch to be inside
d3.dsv, so the warning will only be displayed if d3.dsv is used.

Fixes #1904.