Allow CSP checkNonce and checkHash to pass with 'unsafe-inline' only.

There is a bug that a script will incorrectly not run when a nonce is
specified if 'unsafe-inline' is also specified in the policy and there's
a *second* policy that only specifies 'unsafe-inline'. This is due to a
cascading failure where the initial isAllowedByAllWithNonce check fails
because the second policy doesn't have a nonce, while the later
allowInlineScript check fails because the first policy's nonce
invalidates the 'unsafe-inline'.

This CL allows allowScriptNonce (and allowScriptHash) to pass if
'unsafe-inline' is present (and no hash or nonce is present). This also
adds tests to verify.

BUG=413482

Review URL: https://codereview.chromium.org/568583003

git-svn-id: svn://svn.chromium.org/blink/trunk@181939 bbb929c8-8fbe-4397-9dbb-9b2b20218538