refactor: cleanup ContentSecurityPolicy

[paulbalandan]

Description
Refactors the CSP class.

• Adds precise types to fix phpstan errors
• Normalizes processing of directives (convert all directives values to [directive-value => $reportOnly]). Previously, list of directive values are accepted and later processed to above. This now ensures they are converted early to reduce some logic in the later methods.
• The only "breaking" change here is that the final header value no longer ends in a semicolon, consistent with examples I find on the internet. I think that's not an issue.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide