Update CSP addon.

Now uses `Content-Security-Policy-Report-Only` by default.
Merge pull request #2190 from rwjblue/make-CSP-report-only-by-default

Update CSP addon.