Feature: CSP should allow simultaneous `Content-Security-Policy-Report-Only` and `Content-Security-Policy-Report-Only`

Currently an option exists to allow only reporting of violations:

options.reportOnly is a boolean, defaulting to false. If true, the Content-Security-Policy-Report-Only header will be set instead.

But according to https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#testing_your_policy it should be allowed to include both a Content-Security-Policy and Content-Security-Policy-Report-Only header.

Usage scenario Let's say you have a current CSP policy, but want to evaluate a new, future policy. This means you want to continue using the one you already enforce, but at the same time evaluate the new one. Read more at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

I think this in turn should remove options.reportOnly in a new major release. Users would instead get full functionality via:

app.use(
  helmet.contentSecurityPolicy({
    policy: {
      directives: {
        "script-src": ["'self'", "example.com"],
      },
    },
    reportPolicy: {
      directives: { // or reportPolicy
        "script-src": ["'self'", "example.com", "lolcat.com"],
      },
    },
  })
);

Unfortunately this means the top-level properties needs to be moved into a policy and reportPolicy property. This is to allow options such as options.useDefaults to be set per header.