Update CSP addon.

Now uses `Content-Security-Policy-Report-Only` by default.