Add report-to and general reporting group support to the CSP plugin

The CSP plugin currently supports report-uri, but not [report-to](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to).