Script-nonce support

An example use would be:
```ruby
:script_nonce => lambda { params[:script_nonce] = SecureRandom.hex(16) },
```

and then in your Haml (if you are so inclined):
```haml
%script{type: "text/javascript", nonce: params[:script_nonce]}
```

Minor downside, as far as I know no browser yet supports this for actual enforcement though WebKit itself added support [last year](https://bugs.webkit.org/show_bug.cgi?id=89577). The spec is designed for transparent upgrade though, so you can add it now and benefit silently once it is supported.