Move setting of CSP header to middleware

In order to support mutating the value of the CSP header based on
actions taken while rendering a response (i.e., to support script
hashes), move setting of the CSP header from directly in the
`set_csp_header` method into a middleware,
`SecureHeaders::ContentSecurityPolicy::Middleware`.

This is a pretty significant refactor. Now, the `set_csp_header` method
stores metadata about CSP config in `request.env`, under the key
`secure_headers.content_security_policy`. The middleware then looks for
this metadata and sets the appropriate header(s).

Things got confusing because the variables `options` and `config` are
often used interchangeably, however in the context of
`ContentSecurityPolicy`, they are very different.

I have not yet tested in a Rails app, however the tests do pass.

@oreoshake 
The experimental flag is meant to be used only in the case that you are enforcing and want to add a report-only header. So yes, set both headers.