Check CSP for inline event handlers (#36510)

This also ensures that document now reports all violations and we set
the correct directive.

With these changes, all `script-src-attr-elem` WPT tests pass.

Part of #36437 

Requires servo/rust-content-security-policy#3 to land first

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>

tests/wpt/include.ini

@@ -13,6 +13,8 @@ skip: true
     skip: true
 [content-security-policy]
   skip: false
+  [embedded-enforcement]
+    skip: true
 [cors]
   skip: false
 [css]