Ignore CSP violations from browser userscripts (source-file: user-script)

Add 'user-script' to ignored source files in CspReportController to filter
out false positive CSP violations triggered by browser extensions/userscripts.
Add corresponding test case.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Controller/CspReportController.php

@@ -58,7 +58,8 @@ class CspReportController extends AbstractController
             || str_contains($sourceFile, 'localhost')
             || 'wasm-eval' === $blockedUri
             || 'inline' === $blockedUri && str_contains($sourceFile, 'node_modules')
-            || 'about:blank' === $blockedUri;
+            || 'about:blank' === $blockedUri
+            || 'user-script' === $sourceFile;
     }
 
     /**

tests/Controller/CspReportControllerTest.php

@@ -36,6 +36,25 @@ class CspReportControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(204);
     }
 
+    public function testUserScriptViolationIsIgnored(): void
+    {
+        $client = static::createClient();
+        $payload = json_encode([
+            'csp-report' => [
+                'source-file' => 'user-script',
+                'blocked-uri' => 'eval',
+                'document-uri' => 'https://e-cosplay.fr/page',
+                'violated-directive' => 'script-src',
+            ],
+        ]);
+
+        $client->request('POST', '/my-csp-report', [], [], [
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        self::assertResponseStatusCodeSame(204);
+    }
+
     public function testRealViolationIsProcessed(): void
     {
         $client = static::createClient();