Allow 'unsafe-inline' js

The LastPass Chrome plugin exposes a problem with OC_Template's default CSP. If 'unsafe-eval' is allowed, there is no reason 'unsafe-inline' should not be allowed as well. 

There have been other reports of this (https://github.com/owncloud/core/issues/2307, https://github.com/owncloud/core/issues/2479) blaming LastPass, when in actuality it is OC_Template setting too strict CSP.