fix(csp): fix autodetection of CSP + better docs

CSP spec got changed and it is no longer possible to autodetect if a policy is
active without triggering a CSP error:

https://github.com/w3c/webappsec/commit/18882953ce2d8afca25f685557fef0e0471b2c9a

Now we use `new Function('')` to detect if CSP is on. To prevent error from this
detection to show up in console developers have to use the ngCsp directive.

(This problem became more severe after our recent removal of `simpleGetterFn`
 which made us depend on function constructor for all expressions.)

Closes #8162
the trouble with this is that we're making an assumption that `eval` is disabled --- which it isn't necessarily. I expect this will be fine for most users, but it's not entirely accurate. I guess we need to wait until there is a better way to get this information.