fix: script injection in element locators with parameterized scripts

[Dor-bl]

This pull request refactors the way JavaScript is executed in the element finding methods to improve security and maintainability. The main change is replacing string interpolation in JavaScript execution with the use of argument passing. This helps prevent potential injection issues and makes the code more robust.

JavaScript execution improvements:

• Updated the _find_by_dom method to use eval(arguments[0]) with argument passing instead of directly interpolating the criteria into the JavaScript string.
• Modified the _find_by_sizzle_selector method to use jQuery(arguments[0]).get() and pass the criteria as an argument, rather than interpolating it into the JavaScript string.
• Updated the call to application.execute_script in _find_by_sizzle_selector to pass the criteria as an argument.

[Dor-bl]

@emanlove @serhatbolsu
Can someone please have a look into this one?

[emanlove]

@emanlove @serhatbolsu Can someone please have a look into this one?

Reviewing now ..

[chsinger]

Thanks for the PR @Dor-bl!

Two points from my side:

1. As far as I can tell, _find_by_dom is not used.
   It is not registered in the _strategies dict (there is no dom= locator prefix) and has no callers anywhere in the repo. I think we can delete it completely.

2. It would be great to add a small regression test for the fix, so a future refactoring can't silently reintroduce string interpolation.

[Dor-bl]

Addressed the feedback: removed the unused _find_by_dom method and added a regression test for the script injection fix.