fix: CSP reportOnly behavior

[kenjis]

Description

If we set $reportOnly = true, Content-Security-Policy header has some items.

How to Reproduce

diff --git a/app/Config/App.php b/app/Config/App.php
index 1a5e562dd..03e8eb649 100644
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -461,5 +461,5 @@ class App extends BaseConfig
      *
      * @var bool
      */
-    public $CSPEnabled = false;
+    public $CSPEnabled = true;
 }
diff --git a/app/Config/ContentSecurityPolicy.php b/app/Config/ContentSecurityPolicy.php
index aa18ba9f1..d4a0d0817 100644
--- a/app/Config/ContentSecurityPolicy.php
+++ b/app/Config/ContentSecurityPolicy.php
@@ -24,7 +24,7 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var bool
      */
-    public $reportOnly = false;
+    public $reportOnly = true;
 
     /**
      * Specifies a URL where a browser will send reports

before:

Content-Security-Policy: base-uri 'self'; child-src 'self'; connect-src 'self'; default-src 'self'; form-action 'self'; img-src 'self'; object-src 'self'; script-src 'self' 'nonce-3d1190def4cad593bb96b732'; style-src 'self' 'nonce-ddf1da493df6ee57425ef796';
Content-Security-Policy-Report-Only: img-src data:;

after:

Content-Security-Policy: 
Content-Security-Policy-Report-Only: base-uri 'self'; child-src 'self'; connect-src 'self'; default-src 'self'; form-action 'self'; img-src 'self' data:; object-src 'self'; script-src 'self' 'nonce-d13b60c8c68026e03a3377b7'; style-src 'self' 'nonce-f2471224b8c789bebddbb394'; report-uri /csp-report;

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[MGatner]

I can't say I fully understand it but the code and tests look good.

[lonnieezell]

Side note: One thing that's been on my mental list since initial release was that it would be awesome to have a debug toolbar pane that show the CSP report. Not sure what all that would entail or if it's possible to show in a pane or not, but thought I'd drop the idea here before I forgot again. :)

[kenjis]

@lonnieezell I fixed tests:
https://github.com/codeigniter4/CodeIgniter4/pull/6201/files#diff-d570bc041ece8c213a9f433ebb653b6f7a53434275a379fd0934840954e79af7

I don't know why the original assertions were like those at all.