docs: fix CSP example to only include unsafe-eval in development (#88407)
## What
Fixes the CSP documentation "Without Nonces" example to only include
`'unsafe-eval'` in development mode.
## Why
The example was showing `'unsafe-eval'` without a development check,
which would cause it to be shipped to production. This is inconsistent
with the guidance in the "Development vs Production Considerations"
section which correctly shows how to conditionally add `'unsafe-eval'`
only in development.
## How
Added a `isDev` check using `process.env.NODE_ENV === 'development'` and
conditionally includes `'unsafe-eval'` in the `script-src` directive
only when in development mode.