Add better content security policy support

Instead of needing to specify `unsafe-inline`, allow specifying a "nonce" to the rendered script tags. If this nonce matches the value in the CSP header, the script will be allowed to run.

[MDN docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)