Use nonce attribute for all scripts and preloads if provided

[novascreen]

When implementing a strict CSP with nonces and strict-dynamic, every script and preload requires a nonce.

https://csp.withgoogle.com/docs/strict-csp.html

[jlecomte]

LGTM. Can we get this in soon? Because of this bug, I currently have to add unsafe-inline to the script-src section of my CSP policy, which makes the entire policy somewhat useless... Thanks!

[timneutkens]

Can you add a test for this in test/integration/app-document?

[novascreen]

@timneutkens i added a test, i believe it tests all instances except for the dynamic chunks, not sure how to test those inside of the app-document test suite

[timneutkens]

@novascreen that's fine, no worries 👍

[joaovieira]

This is great. But there is no documentation at all on using nonces. Example in the docs would be much appreciated. Thanks.

E.g. https://github.com/helmetjs/csp#generating-nonces

[novascreen]

@joaovieira there are some details in the README and an example now:
https://github.com/zeit/next.js/tree/canary/examples/with-strict-csp