All: enable CSP report header on production sites

[timmywil]

Ref jquery/infrastructure-puppet#54

I just noticed a CSP violation on all wordpress content sites. It seems any sites generated with Wordpress 6.7 have an added style tag:

<style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>

I'm actually fine not adding an exception for this as it doesn't seem to make a difference on our sites.

Edit: I found a way to omit the style tag.