Add missing report-uri to CSP config

This is supported in Rails 5.2, although it may be deprecated in the future by reports-to.

See:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri