CSP violation: Inline event handlers (onload/onerror) blocked by script-src-attr directive

Description

The library uses inline event handler property assignments (iframe.onload and iframe.onerror) which cause Content Security Policy (CSP) violations when the script-src-attr directive is set.

Location

File: src/utils/dom.ts
Lines: 40-41

iframe.onload = resolve
iframe.onerror = reject