Lint a Content-Security-Policy header string for unsafe-eval, wildcard script sources, and default-src restrictions.