Include environment and release in CSP report URI

[kailan]

from https://sentry.io/settings/syosset/syosset/security-headers:

In addition to the sentry_key parameter, you may also pass the following within the querystring for the report URI:
sentry_environment: The environment name (e.g. production).
sentry_release: The version of the application.

We can pass in the Rails env + current commit SHA as we do with Raven for application errors.

[kailan]

I've manually added the sentry_environment parameter to the app config in staging + production.

TODO: allow the use of a placeholder for the release SHA in the URI.