Add support for inline JS inserted via content-for

## Why?
Addons, such as `ember-svg-jar`, inserts an inline JS. The inline JS generally violates the CSP script-src directive unless one of the following sources are added to the directive:

1. Nonce
2. Hash
3. `unsafe-inline`

### Nonce
Nonce is added to the `` tag as an attribute, as well as in the CSP script-src directive, and needs to be unique for each page request.

For SPA's that are not backed by server-side rendering, a unique nonce-value won't be generated each time.

### Hash
A hash is generated from the contents of the script tag, including all whitespace and line breaks.

### `unsafe-inline`
This defeats the purpose of the CSP script-src, which would allow any inline JS to load.

## Proposal
Generate a hash for every inline JS, and maybe CSS, and add it to the corresponding CSP directive at build time.

From a discussion with @jelhan:

> - Every <script> element (and maybe <style> element) injected into index.html or tests/index.html is allowed in CSP by default
> - ember-cli-content-security-policy addon parses the current content of contentFor hook in its own contenFor hook implementation, extracts all <script> (and maybe <style>) elements, hashes their content and adds the hash to the CSP.
> - It provides a configuration option to restrict this default behavior to some elements (e.g. through a filter function).