restore csp behavior

[colinxfleming]

Thanks for creating an issue! Please fill out this form so we can be sure to have all the information we need, and to minimize back and forth.

• What are we trying to do?
  restore CSP behavior, which we had to change to report only to get the massive webpacker removal out the door

• What feature or behavior is this required for?
  security

• How could we solve this issue? (Not knowing is okay!)
  no idea yet

• Anything else?
  See ditch webpacker in favor of jsbundling/esbuild #2594