This reverts commit 86f7c269, reversing
changes made to 5ece2e4a.

If a policy is set then we should generate it even if it's empty.
However what is happening is that we're accidentally generating an
empty policy when the initializer is commented out by default.

`Rails.application.config.content_security_policy` is configured with no
policies by default. In this case, Content-Security-Policy header should
not be generated instead of generating the header with no directives.
Firefox also warns "Content Security Policy: Couldn't process unknown
directive ''".

Use Object#deep_dup to safely duplicate policy values

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy