d3.csv: support strict Content-Security-Policy.

This is a workaround for a strict Content-Security-Policy such as:

  Content-Security-Policy: script-src 'self';

This policy prevents new Function(<string>), which we rely upon for a
performance optimisation in d3.dsv.  Fortunately, we can simply check if
an exception is thrown and fall back to the slower implementation.

Fixes #1904.