CSP violation when enabling the recorder

Bug Description

Hi,
thank you for the great work.

I am here to report an issue with CSP: as context, the CSP config from the app on which I am running Posthog does not include unsafe-inline for the style-src.

When the session recording feature is enabled, I can see this error on the browser console:

Checking the docs, I thought this was the fix:

      prepare_external_dependency_script: (script) => {
        script.nonce = appNonce;
        return script;
      },
      // this bit in particular
      prepare_external_dependency_stylesheet: (stylesheet) => {
        stylesheet.nonce = appNonce;
        return stylesheet;
      }

But from my tests, it does not fix it. To add more, adding a console.log there to print the files targeted by those functions, the record.js looks to be not one of them.

We have plenty of the errors as from screenshot and they are polluting the browser's console. I wonder if you can suggest a solution.

Thank you,
Luca

Debug info

- [X] PostHog Cloud, Debug information: [please copy/paste from https://us.posthog.com/settings/project-details#variables or https://eu.posthog.com/settings/project-details#variables]
- [ ] PostHog Hobby self-hosted with `docker compose`, version/commit: [please provide]
- [ ] PostHog self-hosted with Kubernetes (deprecated, see [`Sunsetting Kubernetes support`](https://posthog.com/blog/sunsetting-helm-support-posthog)), version/commit: [please provide]

Start by tracing how the session recorder loads record.js and compare that path with prepare_external_dependency_script and prepare_external_dependency_stylesheet. Reproduce the browser CSP error with recording enabled; done means the recorder no longer produces the reported style-src violations under a policy without unsafe-inline.