Remove use of eval() in Tokenizer class

eval() was used to check syntax but the safeguard still allowed code
injection because PHP evaluates classes and functions at compile time.

Leveraging the autoloader, an attacker could achieve remote code
execution by defining a rogue ConfigsSetCommand class.

We now rely on token_get_all()'s TOKEN_PARSE flag 1 to check syntax,
which will throw a ParseError exception just like eval() does, but
without executing the code.

Fixes 0037122, GHSA-v84x-qvhg-f36r