Make SecurityPolicy methods a public API and fully enable the CSP #17923

We introduced it in Matomo 4.5 in https://github.com/matomo-org/matomo/pull/17798

Now it's time to make it a public API see https://developer.matomo.org/guides/apis#process-for-declaring-something-as-public-api-for-plugins

We also want to disable the reporting only by default and instead actually make it apply the rules.