Provide helpful terminal messages to fix web component CSP errors

[wwwillchen]

Fixes #566. This makes it a lot easier to fix CSP errors by printing a helpful message in the terminal. Particularly helpful with #723.

Screenshot:

[richard-to]

Looks like report-uri is deprecated (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri).

Seems like the newer way is report-to, however not all browsers support it yet (Firefox) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to.

---

One thing that could be helpful is to also include the full url that got blocked since there could be multiple files that got blocked from the same domain. So I think it could be important to verify that all the urls were expected ones.

[wwwillchen]

Looks like report-uri is deprecated (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri).

Seems like the newer way is report-to, however not all browsers support it yet (Firefox) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to.

Yeah, I looked into this a little bit, but the lack of Firefox support made me not go down the route. There's also some trickier aspects where it's unclear whether it'll work locally and there may be a delay. For now, I think report-uri is OK (I think lots of Google sites use it exclusively and not report-to) and if it does break eventually, we can switch over to report-to.

One thing that could be helpful is to also include the full url that got blocked since there could be multiple files that got blocked from the same domain. So I think it could be important to verify that all the urls were expected ones.

Good idea. I've included the full blocked URL.