CSP evaluator

Paste a Content-Security-Policy, or fetch one from a URL. Points at unsafe-inline, wildcards, missing object-src and base-uri.