Add GraphQL support

Problem/Motivation

It would be great if we can support decoupled sites by exposing the CSP rules over GraphQL.

Websites that have a dedicated frontend (for example Next.js or Nuxt) don't currently have a way to get the current rules directly from Drupal for including in their HTML. Currently the typical approach is to hardcode a duplicated set of the CSP policy rules in the decoupled frontend and keep it in sync manually whenever the rules change. By exposing the CSP rules over GraphQL any changes made will be available instantly to decoupled frontends.

Proposed resolution

1. Add a csp_headers GraphQL data producer. It returns every enabled policy type exactly the same way ResponseCspSubscriber does: create a Csp object and dispatch CspEvents::POLICY_ALTER. This means the settings, libraries, reporting handlers, theme hooks and third-party alters all apply. It returns a list of {name, value} pairs, one per enabled header, and bubbles the cacheability metadata so changes to the CSP settings or libraries invalidate the result.
2. Add a csp GraphQL extension that exposes the producer, so site owners can simply enable the extension to make sure the frontend developers have the CSP rules available on their GraphQL endpoint.

API changes

A new public method Csp::getHeaderDirectives(), which returns the directives as they are serialized in the header value. Csp::getHeaderValue() now builds its output from it, so the header string is unchanged.