feat: support report-sha256/report-sha384/report-sha512 CSP keywords

[willfarrell]

Clone of #16867, redone to be based off version 3 (main)

Adds support for the CSP hash-reporting keywords report-sha256, report-sha384, and report-sha512 (from the CSP Reporting spec (https://w3c.github.io/webappsec-csp/#reporting)) in the csp config.

Previously these keywords were not in the quoting allowlist, so SvelteKit emitted them unquoted (e.g. script-src report-sha256), producing an invalid header. They also weren't accepted by the Csp.ActionSource type.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 789aabc:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/789aabcbc313c8c9df9c1b0c82ec2e0641a4b292

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17398

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 789aabc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR