feat: Capture CSP violations

[foxable]

CSP violations are usually silent: the browser drops the blocked resource, logs a console warning, and the test still passes. CspCaptor closes that gap by surfacing every violation as structured data.

• The automatic cspFixtures fixture guards against otherwise undetected CSP violations by failing any test that triggers one, without requiring changes to individual test files.
• CspCaptor and captureCspViolations can also be used directly, giving tests the ability to trigger and assert on individual CSP directives.

Features

• CspCaptor: collects a page's securitypolicyviolation events as structured CspViolation objects
• captureCspViolations: factory for creating a CspCaptor
• cspFixtures: ready-to-merge Playwright fixtures that install an auto-starting cspCaptor on every test and fail it on unexpected violations, configurable per test via the ignoreCspViolations option fixture

[changeset-bot]

🦋 Changeset detected

Latest commit: 45bacd1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cronn/playwright-utils	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR