Editorial: header names and values are byte sequences

In the "header list" part of https://w3c.github.io/webappsec-csp/#report-violation backticks ought to be used as per Infra. Probably something like:
```html
« (`<code>Content-Type</code>`, `<code>application/csp-report</code>`) » 
```