Repository: next.js
Issue: CSP with nonce does not work for page router
Labels: bug,Pages Router

### Link to the code that reproduces this issue

https://github.com/noahsmartin/NextJSCSP

### To Reproduce

When using the pages router, adding a nonce to the CSP results in the page not loading necessary scripts. With the app router this works fine. With the pages router following the example code in https://nextjs.org/docs/pages/building-your-application/configuring/content-security-policy causes the <script /> tags that next includes on the root page to not have a nonce and not get loaded. 

1. start the app (npm run dev)
2. Observe console logs in the browser

### Current vs. Expected behavior

I expected no errors from failing to load scripts, but multiple scripts errored. You can see the scripts tag do not have a nonce:

```
    <script src="/_next/static/chunks/webpack.js?ts=1718827141851" defer=""></script>
    <script src="/_next/static/chunks/main.js?ts=1718827141851" defer=""></script>
    <script src="/_next/static/chunks/pages/_app.js?ts=1718827141851" defer=""></script>
    <script src="/_next/static/chunks/pages/index.js?ts=1718827141851" defer=""></script>
    <script src="/_next/static/development/_buildManifest.js?ts=1718827141851" defer=""></script>
    <script src="/_next/static/development/_ssgManifest.js?ts=1718827141851" defer=""></script>
```

The errors look like this 

```
[Error] Refused to load http://localhost:3000/_next/static/chunks/webpack.js?ts=1718827141851 because it does not appear in the script-src directive of the Content Security Policy.
[Error] Refused to load http://localhost:3000/_next/static/chunks/main.js?ts=1718827141851 because it does not appear in the script-src directive of the Content Security Policy.
[Error] Refused to load http://localhost:3000/_next/static/chunks/pages/_app.js?ts=1718827141851 because it does not appear in the script-src directive of the Content Security Policy.
[Error] Refused to load http://localhost:3000/_next/static/chunks/pages/index.js?ts=1718827141851 because it does not appear in the script-src directive of the Content Security Policy.
[Error] Refused to load http://localhost:3000/_next/static/development/_buildManifest.js?ts=1718827141851 because it does not appear in the script-src directive of the Content Security Policy.
[Error] Refused to load http://localhost:3000/_next/static/development/_ssgManifest.js?ts=1718827141851 because it does not appear in the script-src directive of the Content Security Policy.
[Error] Refused to load http://localhost:3000/_next/static/chunks/react-refresh.js?ts=1718827141851 because it does not appear in the script-src directive of the Content Security Policy.
```

### Provide environment information

```bash
Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 23.5.0: Wed May  1 20:12:58 PDT 2024; root:xnu-10063.121.3~5/RELEASE_ARM64_T6000
  Available memory (MB): 65536
  Available CPU cores: 10
Binaries:
  Node: 18.17.1
  npm: 9.6.7
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 15.0.0-canary.37 // Latest available version is detected (15.0.0-canary.37).
  eslint-config-next: N/A
  react: 19.0.0-beta-04b058868c-20240508
  react-dom: 19.0.0-beta-04b058868c-20240508
  typescript: 5.1.3
Next.js Config:
  output: N/A
```


### Which area(s) are affected? (Select all that apply)

Pages Router

### Which stage(s) are affected? (Select all that apply)

next dev (local)

### Additional context

_No response_