Append to existing CSP list in Document::set_csp_list

[servo-wpt-sync]

The Document::set_csp_list method now appends new policies to any existing CspList rather than replacing it. This ensures that CSPs from multiple sources (e.g., HTTP headers and <meta> tags) are merged as expected, following the spec.

This change avoids silently discarding header-defined policies when a <meta http-equiv="Content-Security-Policy"> is present in the document.

Reviewed in servo/servo#36828