matomo: send securitypolicyviolation events

This event gets dispatched in case the CSP blocks something.
This is motivated by browsers handling this differently, for
example spawning a worker via blob: is allowed in chrome, but not in firefox
and things like "worker-src" is not supported in safari..

So having some error reporting there is helpful in case some browser
version somewhere behaves differently.