Add CSP listener on document, not window

[waltjones]

Description of the change

Adding the securitypolicyviolation listener to the window object works on some browsers, including chrome, and headless chrome used in the tests. However, it doesn't work on Safari, and the spec requires it to be added to the document object, not the window object. https://developer.mozilla.org/en-US/docs/Web/API/SecurityPolicyViolationEvent

This PR adds the listener to the document instead of the window.

Type of change

• Bug fix (non-breaking change that fixes an issue)

Related issues

Fixes #978

Development

• Lint rules pass locally
• The code changed/added as part of this pull request has been covered with tests
• All tests related to the changed code pass in development

Code review

• This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached
• "Ready for review" label attached to the PR and reviewers assigned
• Issue from task tracker has a link to this pull request

[cyrusradfar]

lgtm