Add report=uri to X-XSS-Protection

Adds this new `report` argument to the `X-XSS-Protection` header.

Details: https://bugs.webkit.org/show_bug.cgi?id=100892

@oreoshake