nelmio_security.csp_listener can have global scope

The listener does not depend on any other service or input that changes
with each request.
Make ContentSecurityPolicyListener an EventSubscriber