[CSP] Define encoding used for reports

[hillbrad]

http://lists.w3.org/Archives/Public/public-webappsec/2014Dec/0010.html

Right now we're implicitly ending up in the "The default encoding is
UTF-8" of section 3 of RFC 4627, but it might be good to make that
explicit, since JSON does allow other encodings.

In particular, we should make it explicit that UTF8 is used in
preference to \uXXXX escapes.

-Boris