Receive a Content-Security-Policy violation report

Accepts both wire formats: a single kebab-case report under a csp-report key (report-uri, which is what Firefox and Safari send) and an array of Reporting API envelopes (report-to, which Chrome sends and batches). Envelopes whose type is not csp-violation are ignored. Unauthenticated by construction, since browsers send these without credentials; the body is treated as hostile, summarised into the server log, and never echoed back.