[CSP] Incorrect script-src handling

[lobsterkatie]

In messing around with our CSP-handling code and looking at a bunch of example CSP events in the process of teaching the grouphash metadata helpers how to gather data on security reports, I discovered that we're interpreting the unsafe-eval and unsafe-inline keywords backwards.

This is from our logic which turns an incoming CSP report into a Sentry event:

relay/relay-event-schema/src/protocol/security_report.rs

Lines 329 to 332 in 9b39f40

	if self.violated_directive.contains("'unsafe-inline'") {
	"Blocked unsafe inline 'script'".to_string()
	} else if self.violated_directive.contains("'unsafe-eval'") {
	"Blocked unsafe eval() 'script'".to_string()

But according to MDN (here, capitalization mine):

If a page has a CSP header and ‘unsafe-eval’ ISN’T specified with the script-src directive, the following methods are blocked and won’t have any effect:

• eval()
  etc.

And it’s the same idea for unsafe-inline. So IOW, having one of those in your script-src directive ALLOWS eval and/or inline scripts, not blocks them.

According to the spec, inline script violations have blocked-uri: inline and eval violations have blocked-uri: eval, so it seems like that's what we should be looking for instead. (See point 4 here.)

UPDATE: Added getsentry/sentry#81531 to track making sure the sentry side of things is updated once this is fixed.