Improve/Rewrite tests checking for CSP violations

[fred-wang]

See trusted-types/trusted-types*reporting as well as content-security-policy/securitypolicyviolation/source-file.html at least.

These tests seems to cause (or have caused) flakiness and timeouts, and maybe are not up-to-date with the spec.

Two recent PRs:
web-platform-tests/wpt#50098
web-platform-tests/wpt#50058

Two bad patterns that cause the tests to not work well:

• assert_unreached() is called inside a try scope and the exception thrown by the testharness to indicate a failure is discarded.
• The listener to "securitypolicyviolation" is added before actually running the statement that triggers the violation, so it could be possible that the violation is not caught.

I also noticed they are testing SVGScriptElement text sink (which is not defined in any spec currently) but not all the possible injection sinks in the spec (Window or Worker, see #494 (comment)). and the test for the sample is not super script:

// TODO(vogelheim): The current set of tests allows for more variance in the
// sample reports than the current spec draft does. Once the spec has
// been finalized, we should clamp this down to check byte-for-byte
// against the values mandated by the spec.

Some related issues:

https://bugzilla.mozilla.org/show_bug.cgi?id=1937764 for source-file.html
#575
#494

cc @lukewarlow