Change rate-limiting middleware to remove CSP report-only header entirely when not reporting

[robhudson]

Description

Some browsers log a console warning when they detect a Content-Security-Policy-Report-Only header that does not include a report-uri or report-to directive. Currently, the rate-limiting middleware removes these directives when the percentage threshold is reached, leading to this warning.

Proposed Changes

1. For the enforced CSP header:

   • Retain the current behavior: remove the report-uri or report-to directives only when the percentage threshold is reached.

2. For the report-only CSP header:

   • Modify the behavior to completely remove the header when the percentage threshold is reached to avoid unnecessary browser warnings.