connect-src tests allow two non-interopable implementations to both pass

[lukewarlow]

For context see:

CSP issue: w3c/webappsec-csp#120

Chromium Issue: https://issues.chromium.org/issues/41278387

WebKit issue: https://bugs.webkit.org/show_bug.cgi?id=286744

connect-src should no longer throw a SecurityError in the EventSource constructor for example, however, the WPTs allow it to happen (see https://github.com/web-platform-tests/wpt/blob/master/content-security-policy/connect-src/connect-src-eventsource-blocked.sub.html)

These tests should be updated to match the spec (and majority of implementations), so WebKit correctly fails them.

cc @mikewest

[lukewarlow]

Another example of a mismatch is /content-security-policy/connect-src/connect-src-syncxmlhttprequest-blocked.sub.html which allows .send to throw or trigger an error event on the XHR object. In that case all 3 engines throw an exception so XHR.onerror shouldn't allow a test pass.