Content Security Policy supports strict-dynamic keyword as an additional way of allowing inline scripts

The [Content Security Policy page](https://experienceleague.adobe.com/en/docs/experience-platform/tags/client-side/content-security-policy) describes two approaches to supporting inline scripts in a CSP.

1. Using nonces and configuring the Core extension with nonce data (most secure)
2. Using unsafe-inline (least secure)

There is a middleground: the "strict-dynamic" keyword in script-src. It makes it so that any script tag trusted via a nonce can add additional script tags that are automatically trusted, even if they are not given the nonce. So by putting the nonce on the adobe analytics "entry" script, any script that gets added by the entry script can be run without requiring a nonce.

And some additional information: JavaScript code has access to the nonce value of its own element, so it can get the nonce automatically if it is present. Perhaps this would make the CSP nonce property in the Core extension unneeded?

`document.currentScript.nonce`

See https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/nonce

EDIT:
It is also important that a CSP nonce not be stored in an html meta tag (such as to make it accessible as a data element). Doing so risks nonce exfiltration by CSS.
See https://www.webasha.com/blog/what-is-the-new-technique-that-bypasses-content-security-policy-using-html-injection-and-browser-caching

It may also be the case that storing the CSP in a meta tag may make the nonce vulnerable to CSS exfiltration as well.

Start with the linked Content Security Policy page and compare its nonce and unsafe-inline guidance with the strict-dynamic behavior described in this issue. Verify the cautions about document.currentScript.nonce and exposing nonces in meta tags, then update the page when the guidance is accurate and complete.

Written by the indexing model from the issue text.