Content-Security-Policy-Report-Only HTTP header

[ehmicky]

Is your feature request related to a problem? Please describe.
With @middy/http-security-headers, the CSP HTTP header is always named Content-Security-Policy. It would be nice to be able to use Content-Security-Policy-Report-Only as well, for debugging/testing.

Describe the solution you'd like
Helmet uses a boolean option for this, but any other solution works.

Describe alternatives you've considered
A workaround is to rename the header manually after the middleware has run.