add Content-Security-Policy headers when in dev mode

When this is active, the server accepts violation reports via POSTs to
/_/csp-violations, and the CSP header points to that URL, so devs can
see problems immediately.

The patch also includes a small standalone reporting server which can be
used as the target of externally-added CSP headers (e.g. when nginx is
configured to add them). Staging/production deployments will use this,
instead of the built-in endpoint.