Add support for CSP context without "unsafe-eval".

This pull request allows UglifyJS to run without using `new Function` which is forbidden in CSP-enabled context such as Chrome extensions and packaged apps. (For me, I'm trying to use UglifyJS in Chrome extensions.)

This pull request checks whether a global variable `UglifyJS_NoUnsafeEval` is available. If so, it attempts to use other solutions than `new Function`. Although the alternative implementation isn't quite optimized, it would only affect UglifyJS in CSP context and has no performance impact on normal usage. In fact I didn't modify anything related to the original implementation expect wrapping some code in if-statements in `lib/ast.js`.

All tests will pass for the new code if you add `UglifyJS_NoUnsafeEval: true` to the vm creation in `tools/node.js`, which can prove the correctness of the alternative implementation. But I don't know how to modify the test runner so that it can run both versions (with and without unsafe eval).

Please check if this pull request is appropriate for the project. In my opinion this PR won't hurt because it does not change the logic or performance with "normal" code. It does not even touch anything related to parsing, compressing and mangling. It only modifies the initialization part to make it run in CSP context and does nothing else.