Copy CSP nonce to script element inside turbo frames

[CiTroNaK]

PR #192 added support to evaluate script elements in turbo frames. I found out, that it worked for me only when CSP was disabled or sets with unsafe_inline for script_src.

This small change allows to use it when the CSP nonce generation is used in the application.

I am sorry, but I was not able to find a way how to write a proper test for it. Any help with that will be very welcomed. I only tested it locally with the latest Rails with this CSP setting:

Rails.application.config.content_security_policy do |policy|
  policy.script_src :self, :https
end

Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) }
Rails.application.config.content_security_policy_nonce_directives = %w[script-src]

Thank you for any feedback or help with this PR 🙂

[dhh]

This is good. Yeah, we should get a proper CSP test case setup. But let's work on that in a second step.