GHSA-qxc2-j82w-r537

### Summary

`faker.helpers.fake` can be tricked into arbritary code execution.

### Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first. This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

### PoC

Go to https://fakerjs.dev/ Open Browser console and run

````ts await enableFaker(); // or import faker faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`); ````

### Impact

The Fake method claims:

> It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.