fix(wasm): remove cjs loader support

[CPunisher]

Summary

There could be security problems with new Function so we'd better not use it in rspack since it is a library.

Checklist

• Tests updated (or not required).
• Documentation updated (or not required).

[netlify]

✅ Deploy Preview for rspack canceled.

Name	Link
🔨 Latest commit	e2fa3f4
🔍 Latest deploy log	https://app.netlify.com/projects/rspack/deploys/689db49d78599a000909ba8d

[github-actions]

📦 Binary Size-limit

Comparing e2fa3f4 to chore: remove @rsbuild/core (#11383) by CPunisher

🙈 Size remains the same at 47.58MB

[codspeed-hq]

CodSpeed Performance Report

Merging #11283 will not alter performance

_{Comparing 08-05-chore/require (e2fa3f4) with main (edea6a4)¹}

Summary

✅ 17 untouched benchmarks

Footnotes

1. No successful run was found on main (d406a66) during the generation of this report, so edea6a4 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[Copilot]

Pull Request Overview

This PR removes CommonJS (CJS) loader support from rspack's WASM implementation to address security concerns with using new Function. The change simplifies the loader mechanism to only support ES modules.

• Removes CJS loader support that used new Function to emulate CommonJS module loading
• Switches from data URLs to blob URLs for ES module loading
• Adds proper cleanup by revoking object URLs after module loading

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.}