Support for Content-Security-Policy "nonce" pattern

An impermissive Content-Security-Policy is an important part of browser-based web security. For manual applications of third-party scripts (eg GA and FB), the simple addition of a nonce attribute to the script tag allows you to avoid adding overly permissive rules like 'unsafe-eval' or 'unsafe-inline' to your CSP.

If this feature already exists and I'm just missing it, (sorry, and) maybe consider this an issue to add it to the docs. If not, this is a request to add the ability to utilize existing APIs to add a string nonce to the attributes of the resulting script tags.

Thanks for your consideration!

The issue names no files, tests, or entry points. Inspect the existing APIs for manually adding third-party scripts and the documentation describing script-tag attributes; the work is done when callers can provide a nonce and the resulting script tags include it without requiring permissive CSP rules.