Add support for CSP Sources to be for the CSP Admin, UI or Both

[GeekInTheNorth]

Currently the CSP Sources are applied to all routes within the solution. Ideally sources required by the CMS Admin interface should not be included within the sources for the core website.

Ideally each source would have an additional dropdown option which would include this setting.

[rsudworth]

Great to see version 3, thank you. Under my post at #270 you talked about v3 having a fix for the issue of poor nonce support in the admin, but I am still having issues there. Does this feature being open mean it's still a work in progress or have I configured something wrong? Currently I can't get rid of unsafe-inline on my front end without nonce+strict-dynamic, but that then breaks the CMS.

[GeekInTheNorth]

The Nonce should no longer be getting generated on the back end, this appeared to be related to the menu provider of all things, there was a setting that was forcing a page context to always exist when the menu was visible.

Personally I'm not using 'strict-dynamic' as that assumes you won't be providing a list of allowed domains and I find it can be problematic where GTM is concerned.

In terms of this issue, I'm planning for this to be the next item that I address. It will probably mean compressing the CSP back into It's own sub-menu hidden behind a list of different CSP configurations. I'm considering adding a host picker to this or a path matching. I'll still working on the design of it here.