use less nonces, but use script_hash PoC

Similar to https://github.com/OWASP/railsgoat/pull/174, use secure_headers to whitelist inline script content. This time, we leveraged the hash feature in secure_headers. We must use nonce in the case where the js is dynamic, but we can cover all other cases with hashes. 

Nonce branch:
  46 changed files  with 72 additions and 46 deletions.

This branch:
  12 changed files  with 33 additions and 13 deletions.