Introduce loophole to workaround content security policy violations

This introduces a hack to enable the use of `new Function` in various locations in the vendored emmet code. This is normally disallowed by CSP, but using the `loophole` npm gives us the ability to work around the restriction.

@ptoomey3 I wonder how many security loopholes are introduced by allowing this here.