Add ability to apply two headers support tuning policies through experimtation

Let's say you currently use CSP in "enforce" mode. You think you can tighten your policy, but you don't want to break your site. In addition to the "enforce" header, apply a "report-only" header with a tighter policy.

Use the reports from the report-only to test what would be applied to the "enforce" header.