App Router: add CSP nonces to segment-owned script tags

App Router scripts emitted for `loading`, `error`, and `template` segment files must receive the request CSP nonce. Without it, a nonce-based `script-src` policy blocks client chunks owned only by those segment files.

Upstream: https://github.com/vercel/next.js/commit/8b037a6748d6b09b040efd3354a15bc58fcf6830

Ensure segment-owned scripts receive the same request nonce as layout and page assets. Add coverage using a `strict-dynamic` nonce CSP where loading/template client chunks are not otherwise included by the page, and verify browser hydration runs without CSP violations.

Start by tracing how App Router scripts for `loading`, `error`, and `template` segment files are emitted and how layout/page assets receive the request CSP nonce. Add coverage with a `strict-dynamic` nonce CSP where loading/template client chunks are absent from the page's other assets. Done means those scripts carry the nonce and browser hydration runs without CSP violations.

Written by the indexing model from the issue text.