Add basic CSP functionality

[empijei]

The plugin should implement the following features:

1. Have a configurable setup

• Enforcement or Report-Only
• Enable strict-dynamic (defaults to disabled)
• Enable unsafe-eval (defaults to disabled)
• Set a reporting endpoint or group (defaults to nothing for the time being, it will be a handler that the plugin installs later)
• Set base-src (defaults to none)
• Add a set of hashes (defaults to empty)

2. Set a Content-Security-Policy header
   The policy should be a strict CSP and nonces should be generated in the Before phase. The plugin will be responsible of putting the nonce in the request context for later retrieval.

[mattiasgrenfeldt]

I'll start working on this