Add CSPHeaderEvent, CSP hash-reporting sources and Hash block tags

[aubes]

• CSPHeaderEvent: dispatched on every response after active groups are resolved and before headers are rendered. Listeners can mutate the active CSPPolicy instances to apply cross-cutting changes.
• CSP Level 3 hash-reporting sources: 'report-sha256', 'report-sha384', 'report-sha512' added to the CSPSource enum. Use them in script-src / style-src to ask browsers to include the SHA hash of the blocked resource in violation reports (useful for iterating a strict-dynamic policy).
• Hash block tags: {% csp_script_hash %}...{% end_csp_script_hash %} and {% csp_style_hash %}...{% end_csp_style_hash %} capture the inline content, compute its sha256 hash, and add it to the corresponding directive. No nonce attribute on the rendered tag, so the page stays cache-friendly. See docs/twig.md#hash-block-tags.