Respect route-level contentSecurityPolicy: false setting

[AlexandrHoroshih]

Hello and thanks for great project!

I noticed, that currently the contentSecurityPolicy: false is allowed by types (since it is a original's helmet valid configuration), but is not actually respected by @fastify/helmet and always falls back to helmet defaults.
So now it is not possible to remove Content-Security-Policy header for one specific route, even though configuration typings are allowing for that and the rest of the headers supports that - which is pretty confusing 😢

It happens because of how CSP Nonce generation feature is currently implemented and i have added a fix for that + test, so contentSecurityPolicy: false is also respected at individual route level.

Documentation is not changed, since don't think it is needed - current docs are describing the way to pass custom helmet configration for specific routes and contentSecurityPolicy: false is a valid case of helmet configuration.
I had checked that in the checklist anyway, since there is no other option to highlight that documentation doesn't need any further changes in this PR

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[Uzlopak]

LGTM

[Uzlopak]

Thank you for the PR and the explaination. :)