DEV: Only include "report-sample" in CSP when reporting is enabled (PR #9337)

The “report-sample” directive is only relevant if reporting is enabled (and CSP reporting should only be enabled when debugging implementations). Including it also raises a console warning in Safari, so the default policy is cleaner without it.

The sample is now also included in the Logster warning.