Short-circuit && and || in CSP evaluator (#4823)

The BinaryExpression handler always evaluated both sides, so guards like
`a && b()` and `a || b()` ran `b()` unconditionally.