fix: allow cypress-axe to be used when csp is set to deny eval()

[RenFraser]

When 'unsafe-eval' is used on a web page, cypress-axe can't run because the injectAxe() function calls window.eval().

From the Mozilla docs:

Warning: Executing JavaScript from a string is an enormous security risk. It is far too easy for a bad actor to run arbitrary code when you use eval(). See Never use eval()!, below.

This commit updates the injectAxe() function to remove eval so that users of unsafe-eval can still use cypress-axe without having to override the injectAxe() function.