Add support for CSP

[jvoisin]

It would be amazing to have CSP support in Airsonic, since it's not uncommon to find XSS in airsonic/subsonic/libresonic/… codebases.
Unfortunately, it's non-trivial to make the codebase compliant.

• Get rid of <input type="button" onclick="location.href='XXX'"> (Remove inline javascript on the cancel buttons #945)
• Try to move inline javascript into dedicated files
• If moving all the javascript to dedicated files isn't possible, investigate the usage of nonces
• Try to eradicate the usage of eval
  • It's used in prototype.js Get rid of prototype.js #1094

[jvoisin]

For nonces we would have to generate a random string per request, and shove it into each <script> as well as in a header.

@muff1nman do you know how this could be done in Spring?