fix: normalize string values and keys in ContentSecurityPolicy::addOption()

[gr8man]

Description
Fixed ContentSecurityPolicy::addOption() and addToHeader() converting string values directly into array keys, which created invalid entries for empty strings, prevented keyword quoting for space-separated lists, and caused a fatal TypeError in PHP 8 strict mode when numeric strings were converted to integer array keys.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide