Drop blocked-uri entirely from csp-reports for the frame-src directive

[fmarier]

As discussed on web-platform-tests/wpt#27384, reporting the blocked-uri for the in CSP reports is problematic in the presence of redirects. Chrome settled on two things:

1. truncating the URL down to the origin for cross-origin reports
2. using the request URL and not the final post-redirect URL for directives other than frame-src (https://issues.chromium.org/issues/40054636)

The commit implementing this second mitigation has the following comment:

we should probably consider dropping reporting completely for frame-src.

though that was never done, as can be seen on my test page.

I don't know whether they will ever do it, but I propose we drop the blocked-uri entirely for the frame-src directive in the meantime.

Also reported to us in https://hackerone.com/reports/3027234.