Fix support for mutliple script hashes

There exists a bug which causes ian improperly formatted `script-src`
expression for multiple script hashes. As is, the output for two hash
`abcde` and `fjhij` is:

    script-src 'sha256-abcde fghij'

This should be:

    script-src 'sha256-abcde' 'sha256-fghij'
fixed & force-pushed