`cloudfront`: Support `Content-Security-Policy-Report-Only` header

### Describe the feature

Support setting 'report-only' mode for CSP in the `ResponseHeadersPolicy`
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

### Use Case

> The HTTP Content-Security-Policy-Report-Only response header allows web developers to experiment with policies by monitoring (but not enforcing) their effects. These violation reports consist of [JSON](https://developer.mozilla.org/en-US/docs/Glossary/JSON) documents sent via an HTTP POST request to the specified URI.

### Proposed Solution

Add a field `ResponseHeadersContentSecurityPolicy.reportOnly` as an optional boolean that defaults to `false`. Internally, this could tack the `-Report-Only` suffix to the header.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.126.0

### Environment details (OS name and version, etc.)

n/a

Start by locating the CloudFront implementation of ResponseHeadersContentSecurityPolicy and ResponseHeadersPolicy, then inspect the related tests or examples for response header policies. Confirm how the policy header name is assembled and add coverage for reportOnly behavior; done means the optional field defaults to false and selects the report-only CSP header when enabled.

Written by the indexing model from the issue text.