Fix pubspec.yaml syntax around '-polymer --csp' flag

TBR

This should complete the list of all we can do in relation to #1978 on the code side (the other part being #3178). The rest will be fixed by upgrading to the new Polymer.