CSP Violation Fixes for script-src "Webpack"

[fledgling-vish]

Before submitting the PR, please make sure you do the following

• It's really useful if your PR relates to an outstanding issue, so please reference it in your PR, or create an explanatory one for discussion. In many cases features are absent for a reason.
• This message body should clearly illustrate what problems it solves. If there are related issues, remember to reference them.
  'nonce-{nonce}' in CSP header for script-src prevents execution of main file because of the absence of nonce attribute.
• Ideally, include a test that fails without this PR but passes with it. PRs will only be merged once they pass CI. (Remember to npm run lint!)

Tests

• Run the tests tests with npm test or yarn test)

[benmccann]

Also related is #1232

[fledgling-vish]

@benmccann I have reduced the scope of this PR to just deal with srcipt-src. Fixing style-src is gonna take a lot of time at my end which I currently don't have.

[benmccann]

This looks to me like it's going to generate <script${nonce_attr}></script><script${nonce_attr} src="${main}" defer></script>. It seems pretty hacky to have that empty script tag in there. Most of that is from before your PR, but if we're going to be touching this area I think it would be nice to do that small cleanup rather than just putting more code on top of it

[fledgling-vish]

@benmccann I don't think an empty script tag will be added. I verified it as well. Attaching the screenshot below.

[fledgling-vish]

Line 296 can give you more context as well https://github.com/sveltejs/sapper/pull/1395/files#diff-9c713b090053bf2158dc7db4484fb401R296

[benmccann]

Thanks for the explanation! This looks okay to me