Fix reporting when only the report-only CSP header is present (#38002)

This was a bit confusing at first, but the report-only only
had an effect if it was used in conjunction with the regular
CSP header. This is incorrect, as the report-only header
can be present on its own.

Additionally, there was double-logic for parsing the CSP list
values, since we can only concatenate CSP lists if we have
an initial value, which requires a concrete policy value.

Therefore, abstract that way by looping over both headers and
handling the case where initially it is `None` and, if the
CSP header is not present, still `None` when we parse
the `report-only` header.

Additionally, update a WPT test. It was expecting the image
to load, yet was showing the fail image.

Part of #4577

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>

tests/wpt/meta/content-security-policy/reporting/multiple-report-policies.html.ini

@@ -1,6 +0,0 @@
-[multiple-report-policies.html]
-  [2-Violation report status OK]
-    expected: FAIL
-
-  [1-Violation report status OK]
-    expected: FAIL

tests/wpt/meta/content-security-policy/reporting/report-multiple-violations-01.html.ini

@@ -1,6 +1,3 @@
 [report-multiple-violations-01.html]
-  [Violation report status OK.]
-    expected: FAIL
-
   [Test number of sent reports.]
     expected: FAIL

tests/wpt/meta/content-security-policy/reporting/report-multiple-violations-02.html.ini

@@ -1,6 +1,3 @@
 [report-multiple-violations-02.html]
-  [Violation report status OK.]
-    expected: FAIL
-
   [Test number of sent reports.]
     expected: FAIL

tests/wpt/meta/content-security-policy/reporting/report-only-unsafe-eval.html.ini

@@ -1,6 +0,0 @@
-[report-only-unsafe-eval.html]
-  [SPV event is still raised]
-    expected: FAIL
-
-  [Violation report status OK.]
-    expected: FAIL