Add unsafe-inline and unsafe-eval script policies