Move setting of CSP header to middleware

In order to support mutating the value of the CSP header based on
actions taken while rendering a response (i.e., to support script
hashes), move setting of the CSP header from directly in the
`set_csp_header` method into a middleware,
`SecureHeaders::ContentSecurityPolicy::Middleware`.

This is a pretty significant refactor. Now, the `set_csp_header` method
stores metadata about CSP config in `request.env`, under the key
`secure_headers.content_security_policy`. The middleware then looks for
this metadata and sets the appropriate header(s).

Things got confusing because the variables `options` and `config` are
often used interchangeably, however in the context of
`ContentSecurityPolicy`, they are very different.

I have not yet tested in a Rails app, however the tests do pass.

@oreoshake 
I think we need another config value. If I'm enforcing the policy, and I'm experimenting with hash sources in the policy, that could break things if applied to the enforcing policy. Once I'm ready to enforce the hash restrictions, I'd want to set the hash both headers.