adjust CSP policies to report-only mode
adjust CSP policies to report-only mode

Tim and I just spent some time pairing on the best way to get algolia
backported from bk/bk to this app.

We explored leaving CSP enforced, but that requires allowing
`unsafe_eval` in production and that's not ideal. It turns out CSP on
bk/bk is in report-only mode as well, and docsearch is violating it
(with a report) each time someone searches.

So for now, we've configured this appto behave the same way.

We'd love to start enforcing CSP on the docs app, but there's been
little movement on docsearch adapting to be more CSP friendly (see
https://github.com/algolia/docsearch/pull/773).

Algolia have an alternative JS library that is CSP friendly and we'd
love to use it.  Maybe that's our best path to enforcing CSP?

https://www.algolia.com/doc/guides/building-search-ui/what-is-instantsearch/js/

buildkite/docs,buildkite/docs,buildkite/docs,buildkite/docs