fix: Incorrect Security Stats when using --enableAutoCsp

[aaronshim]

In the reports webapp, we see a large number of "Security" findings in the runs if we use the --enableAutoCsp flag

This is because in stats.ts, we are counting the number of CSP reports that are seen during the WebDriver session with autoCSP enabled. Even though we are not tracking Trusted Types violations at this moment, we end up counting Trusted Types violations as a part of security findings. This is currently problematic because the version of the strict-csp HTML transformation library we use generates a lot of false positive Trusted Types violations as a part of the loader script.

We will not count any Trusted Types violations as security findings until strict-csp is updated to no longer produce false positives. This currently aligns with the name of the variable in the checking-- numCspViolations should count only CSP violations. To make this future-proof, I've separated out CSP and TT findings in stats.ts-- and we can start counting numTrustedTypesViolations in the future!

Thanks to @devversion for noticing this!