Disable nonce when using ISR

Describe the problem

SvelteKit prevents you from using a nonce for CSP when prerendering pages (since otherwise it's predictable, and if it's predictable then it offers no protection), but not when you're using ISR.

Describe the proposed solution

Since the framework can't know that it's being used for ISR (SvelteKit is just handling a normal request, as far as it's concerned) I guess we'd basically have to check the config inside the adapter to make sure that mode === 'hash' if a) the app contains ISR routes, b) CSP config is present and c) it doesn't include unsafe-inline.

In the default case where mode === 'auto', I guess we could also add an API for telling SvelteKit 'we are effectively prerendering'. Or maybe we could just abuse the existing internal API for that.

Alternatives considered

No response

Importance

nice to have

Additional Information

No response

Start by tracing how the adapter reads config and handles ISR routes, then compare that with the CSP nonce behavior described here. Resolve how to identify ISR, what should happen when mode is hash, and whether mode auto needs an API; the work is done when predictable nonces are prevented for ISR without unsafe-inline.