feat: Add cspReport utility to generate CSP reports and recommendations

[foxable]

Adds cspReport, which evaluates a Content-Security-Policy header against a set of recommended directives and renders the result as a Markdown report suitable for file snapshots. Nonces are masked deterministically, and missing fetch directives are evaluated via their default-src fallback. Also adds getCspHeader to extract the header from the (nullable) result of page.goto(), returning an empty string if it is missing.

Example

import { cspReport, getCspHeader } from "@cronn/playwright-utils";
import { expect, test } from "@playwright/test";

test("has a strict Content Security Policy", async ({ page }) => {
  const response = await page.goto("/");
  const cspHeader = await getCspHeader(response);

  expect(cspReport(cspHeader)).toMatchTextFile({
    fileExtension: "md",
  });
});

# CSP Report

## Detected Directives

| Directive                   | Value               |
| --------------------------- | ------------------- |
| `upgrade-insecure-requests` | _none_              |
| `trusted-types`             | `angular`           |
| `require-trusted-types-for` | `'script'`          |
| `default-src`               | `'self'`            |
| `script-src`                | `'strict-dynamic'`  |
| `style-src`                 | `'nonce-[NONCE_0]'` |
| `object-src`                | `'none'`            |
| `base-uri`                  | `'none'`            |
| `form-action`               | `'self'`            |
| `frame-ancestors`           | `'none'`            |

## Recommendations

- `script-src`: Add a nonce source

[changeset-bot]

🦋 Changeset detected

Latest commit: 9bd0712

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cronn/playwright-utils	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR