Enable Rails 5 content_security_policy for js snippet

[waltjones]

Issue #698

Rails 5.2 has built in support for CSP: https://edgeguides.rubyonrails.org/security.html#content-security-policy

Apps that want to enable CSP have two choices for inline JS, such as the rollbar js snippet:

1. Set the 'unsafe-inline' policy, which is global and removes security for inline JS, or
2. Use a nonce, which Rails CSP supports, but requires the snippet to use the nonce.

This PR supports both options by only including the nonce when expected.

[rokob]

Looks good to me