This event gets dispatched in case the CSP blocks something.
This is motivated by browsers handling this differently, for
example spawning a worker via blob: is allowed in chrome, but not in firefox
and things like "worker-src" is not supported in safari..

So having some error reporting there is helpful in case some browser
version somewhere behaves differently.

In greenlight we copied this code for scanning images, either from
real image files, or from PDF files converted to images via pdf.js.

To avoid duplication clean up the internal API and expose it.

Also write some unit tests for the scan engine while at it.