Remove RCE-vulnerable JavaScript engine (CWE-94)

[MorielHarush]

Description:
This PR removes the javascript engine from lib/engines.js. The current implementation uses eval(), allowing for Remote Code Execution (RCE) by default.

The Vulnerability:
gray-matter automatically identifies the engine from the delimiter (e.g., ---javascript). Since the javascript engine is registered in the core library, an attacker can execute arbitrary system commands simply by providing a malicious string to the matter() function—even with zero configuration from the developer.

Proof of Concept (PoC):

JavaScript
const matter = require('gray-matter');
const malicious = `---javascript
require('child_process').execSync('id').toString()
---
Hello world`;
const result = matter(malicious); 
console.log('[RCE] Command output:', result.data);

Impact:
Any application using gray-matter to parse user-supplied content is vulnerable to full system compromise. This is a critical security flaw (CWE-94: Improper Control of Generation of Code).

Proposed Changes:

• Removed the javascript engine from lib/engines.js.
• Users who require dynamic front-matter should now be required to implement their own (secure) parser and pass it explicitly in the options.