Upgrade chart.js to v3, which allows us to get past an existing security issue with v2 that makes it much harder to implement a CSP in internal, namely that v2 would require us to enable unsafe-inline.
This required changing some options objects for v3, but I think I did it correctly. It would be good to bang away at this in dev to make sure that the charts are all behaving as expected.