[CSP] Update `script-src` handling once relay bug is fixed

Once [https://github.com/getsentry/relay/issues/4323]() is fixed, we'll need to audit our server-side code to make sure what we're doing still makes sense.

Spots to check:

[https://github.com/getsentry/sentry/blob/4f3bf8db4dcda3d028d656f9a544396407147a39/src/sentry/interfaces/security.py#L191-L205]()
[https://github.com/getsentry/sentry/blob/4f3bf8db4dcda3d028d656f9a544396407147a39/src/sentry/grouping/strategies/security.py#L74-L80]()

Known issues:

* If you set `"blocked_uri": "eval"`, 1) we add a colon to the end of it for some reason, 2) we don't recognize it as a "local script-src violation" for grouping purposes. We'll have to investigate where to find the origin data - in `document_uri` or `referrer`, maybe? (That will rely on relay not scrubbing them, of course.) The same is likely true for `inline`.
* Why do we only care about local unsafe-eval and unsafe-inline violations, and not non-local ones?