CSP smoke test

We should have a smoke test that tests Lighthouse on a page with a very strict CSP `default-src 'none'` to make sure a CSP doesn't block Lighthouse from running.

Some implementation notes:
- I think we should make a separate smoke category for csp tests. This doesn't fall neatly into any category.
- We should probably deliver the CSP through an HTTP header so we have access to the `sandbox` directive which was causing issues in https://github.com/GoogleChrome/lighthouse/issues/11925. Unfortunately this means we need to find a way to deliver the CSP header specifically for this smoke test.

Related:
https://github.com/GoogleChrome/lighthouse/issues/7159#issuecomment-744058999