Fixes #16

The report-to CSP syntax was being generated incorrectly, it should be a string group-name, with associated Report-To header - see examples.

This does a few things:

• Fixes the syntax and adds the Report-To header if the report-to directive is set
• Adds a bunch of tests for each different scenario
  • If the environment variable is set with a single url, then both report-uri and report-to directives are included
  • If the environment variable is set with multiple urls (comma separated) then just the report-to directives are included, as report-uri doesn't support multiple endpoints
  • If the environment variable is not set, then either report-uri or report-to directives, or both, can be set manually
  • If either directive is set with an empty string, then the directive is removed, for example I might want to override the environment variable for a single url and only use report-uri.

I have kept the previous, invalid, directive syntax for report-to and tidied it up when the header is added, this should mean this is backwards compatible.

And lastly, a cosmetic change - I added a space after each ; in the CSP header. This is valid syntax and makes it much easier to read.