Function csp_report 

pub async fn csp_report(__arg0: State<AppState>, body: Bytes) -> StatusCode

CSP violation report sink (POST /__edgeguard/csp-report). Browsers POST a JSON report here when headers.csp_report_uri points at it; we count and log it, then 204.