feat(csp): support generating nonce for scripts and links in ssr

[clarkdo]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

Related to #7451

In some cases of CSP like using strict-dynamic, resources in self domain may also be disallowed from loading, so this pr is adding an option generateNonce on CSP for generating a cryptographic nonce to CSP header and HTML resources tags.

• Add render.csp.generateNonce for generating nonce for scripts and links in SSP
• The random nonce value is only be used for a single HTTP request. Refer to: https://content-security-policy.com/nonce/

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly. (PR: #)
• I have added tests to cover my changes (if not applicable, please state why)
• All new and existing tests are passing.

[codecov-commenter]

Codecov Report

Merging #9621 (8788bf1) into dev (a3b2fd8) will decrease coverage by 0.12%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##              dev    #9621      +/-   ##
==========================================
- Coverage   65.15%   65.03%   -0.13%     
==========================================
  Files          94       94              
  Lines        4107     4115       +8     
  Branches     1126     1130       +4     
==========================================
  Hits         2676     2676              
- Misses       1152     1156       +4     
- Partials      279      283       +4     

Flag	Coverage Δ
unittests	65.03% <0.00%> (-0.13%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
packages/config/src/options.js	95.83% <ø> (ø)
packages/vue-renderer/src/renderers/ssr.js	0.00% <0.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a3b2fd8...8788bf1. Read the comment docs.

[danielroe]

Sorry for the long delay in merging this!