Fix the flaky csp_report default-filter test
Alert on security signals instead of accumulating them
Log CSP violations that the default filter was discarding
Add CSP violation reporting