feature request: content_security_policy_report_only in manifest.json

[Jack-Works]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

[Jack-Works]

Without this feature, I cannot specify a Report Only CSP because it does not accept CSP Report Only via a meta tag.

[Jack-Works]

Chrome tracking bug https://bugs.chromium.org/p/chromium/issues/detail?id=1315890

[carlosjeurissen]

This depends on the not yet further explored discussion about CSP reporting initiated by #97 during #166. Seems it could be a good opportunity to talk about this.

[Jack-Works]

I hope we can add it consistently as the status quo API asap. There is no way to opt-in the CSP in our extension in a gradually way 😂

[carlosjeurissen]

As for syntax, I'm proposing to use an object structure like:

"content_security_policy_report_only": {
  "extension_pages": "...",
  "sandbox": "..."
}

This aligns it with the content_security_policy syntax proposed by Google and Mozilla. Which makes sure it is flexible and familiar.