Derive security header report url from DSN

I know that this could be done somewhat trivially by parsing the DSN URL in my own code (assuming the format is stable).
However, it'd be convenient to have this as part of the SDK, so one could do just get it via something like `sentry_sdk.csp_report_url`.

Start by reading how the SDK represents and parses the DSN, then examine the proposed `sentry_sdk.csp_report_url` access pattern. Define the expected derived URL and add coverage showing that it is available from a DSN; the issue does not name a source file or test location.

由索引模型根据 Issue 内容生成。