IDL: Put default values on 2 members of SecurityPolicyViolationEventInit

The dictionary in spec has a default value empty string on "referer" and
"sample", but we did not have.
This CL adds the default values, and updates some tests expectation.

Updated tests expected an event SecurityPolicyViolationEvent returns
null for "referer" and "sample" attributes, but their type are string
and shouldn't be null.  This CL updates to expect empty strings.

Bug: 839389
Change-Id: If8c9a9c2c7b2882ecbd0ab63df467e2b1bafa047
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2208316
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Auto-Submit: Hitoshi Yoshida <peria@chromium.org>
Commit-Queue: Hitoshi Yoshida <peria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#770487}

content-security-policy/reporting-api/reporting-api-sends-reports-on-violation.https.sub.html

@@ -27,14 +27,14 @@
           assert_equals(reports[0].type, "csp-violation");
           assert_equals(reports[0].url, document_url);
           assert_equals(reports[0].body.documentURL, document_url);
-          assert_equals(reports[0].body.referrer, null);
+          assert_equals(reports[0].body.referrer, "");
           assert_equals(reports[0].body.blockedURL,
                         base_url + "support/fail.png");
           assert_equals(reports[0].body.effectiveDirective, "img-src");
           assert_equals(reports[0].body.originalPolicy,
                         "script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-group");
           assert_equals(reports[0].body.sourceFile, document_url);
-          assert_equals(reports[0].body.sample, null);
+          assert_equals(reports[0].body.sample, "");
           assert_equals(reports[0].body.disposition, "enforce");
           assert_equals(reports[0].body.statusCode, 0);
           assert_equals(reports[0].body.lineNumber, 53);

reporting/path-absolute-endpoint.https.sub.html

@@ -28,14 +28,14 @@
           assert_equals(reports[0].type, "csp-violation");
           assert_equals(reports[0].url, location.href);
           assert_equals(reports[0].body.documentURL, location.href);
-          assert_equals(reports[0].body.referrer, null);
+          assert_equals(reports[0].body.referrer, "");
           assert_equals(reports[0].body.blockedURL,
                         `${base_url}/reporting/resources/fail.png`);
           assert_equals(reports[0].body.effectiveDirective, "img-src");
           assert_equals(reports[0].body.originalPolicy,
                         "script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-group");
           assert_equals(reports[0].body.sourceFile, location.href);
-          assert_equals(reports[0].body.sample, null);
+          assert_equals(reports[0].body.sample, "");
           assert_equals(reports[0].body.disposition, "enforce");
           assert_equals(reports[0].body.statusCode, 0);
           assert_equals(reports[0].body.lineNumber, 66);