Better CSP support for themes

Brainstorming some options:

• Provide a service for declaring additional sources - any module or theme could define additional sources prior to the response / policy alter event. Those sources would be merged into the policy after CSP builds it from config and library definitions, but before the alter event is dispatched. This could have some limitations in cases where multiple modules need to collaborate (e.g. disabling a nonce if 'unsafe-inline' is already present in a directive)
• Add a method to the csp.nonce service for flagging directives which should have a nonce source added (if possible). This would be accessible to themes, and simpler for modules than needing to implement a csp.policy_alter subscriber which adds the value from Nonce::getSource() to directives (and could handle the logic for cases like <code>'unsafe-inline' being required by something else).
• Parse additional values from a new property on library definitions. This would make adding a font-src for CSS that loads fonts much simpler.
• Use the render metadata system to bubble up additional CSP configuration from render elements.

Another possibility:

• Dispatch a hook for themes with ThemeManager::alter();.

I think adding a hook would cover the most bases, but some of these other propositions would also be a good idea DX-wise.

I've created these separate issues:
✨ Allow CSP to be added by render elements Needs review
✨ Enable specifying additional directives in library definitions Active

and with the theme hook already in 1.24, I think themes will be well optioned 🙂