fix(csp): allow duplicate report-* directives

[argl]

Description

If a CSP entry contains duplicate report-to or report-uri entries, the entry is still considered valid, similar to browser behaviour. Only the first encountered value is taken into account.

(MP-1799)

Motivation

CSP entries were flagged as invalid because of duplicate report-uri values. After discussion with the security team, report-* directives were deemed ok to contain duplicates in our scans. Other duplicates are still flagged as invalid as in the original observatory.

Additional details

There is a new result type CspImplementedButHasDuplicateDirectives (0 points) that kicks in when the CSP test generally passes, but duplicate report-* directives were detected.

[caugner]

LGTM overall, just nits.

[caugner]

Actually, this one is not a nit.

[caugner]

LGTM, just one more thought: Wouldn't it be better to have a general _warnings key that is an array of warning objects, and could be used for other checks as well:

{
  "_warnings": [
    {
      "type": "duplicate_keys",
      "keys": ["report-to"]
    }
  ]
}

[argl]

If we need any more warnings, I'll extend the scheme. There is no real infrastructure to conveigh these warnings to the user yet, though, apart from matching these to result constants.