All: add CSP report only header for all blog sites

[timmywil]

• allow scripts, styles, and images from code.jquery.com

I abandoned setting them via nginx since we don't know why they weren't getting set. I've set a minimal, report-only header for the blogs and will evaluate if any exceptions are needed after deployment.

An advantage of this strategy is no changes to the infra repo will be needed when the blogs are eventually switched over to use jquery-wp-content.

Ref jquery/infrastructure-puppet#54

[Krinkle]

FYI: blog theme in puppet uses default of ensure present, not latest. It also has no notify webhook yet. You can use ssh to wpblogs and git pull the directory in question. I usually keep note of git log -1 beforehand, so that I can easily git checkout $prevCommitHash to rollback in case of trouble.

[timmywil]

I also had to run the puppet agent to get it to update, but the headers are showing up now. And I already see some exceptions that are needed (e.g. typekit scripts)