fix: append nonce alongside unsafe-inline instead of replacing it

[SisyphusZheng]

Problem

When useNonce: true, the CSP middleware replaces 'unsafe-inline' with 'nonce-{value}' using
eplaceAll():

script-src 'self' 'nonce-deadbeef42'

This prevents users from keeping 'unsafe-inline' as a fallback for older browsers that don't support CSP Level 3 nonces — a pattern recommended by web.dev and modern CSP guides. Users who need both Fresh's nonce-based inline scripts AND a browser fallback cannot achieve this.

Per discussion in #3813, the fix is simpler than adding a new option: stop stripping 'unsafe-inline' and instead append the nonce alongside it.

Solution

Change
eplaceAll →
eplace, so the nonce is appended while 'unsafe-inline' stays:

script-src 'self' 'unsafe-inline' 'nonce-deadbeef42'

Users who want only the nonce simply omit 'unsafe-inline' from their CSP directives. Users who want the fallback keep it. No new API surface needed.

Changes

• csp.ts —
  eplaceAll("'unsafe-inline'", 'nonce-') →
  eplace("'unsafe-inline'", 'unsafe-inline' 'nonce-')
• Updated JSDoc for useNonce
• csp_test.tsx — renamed tests, added test for directive without 'unsafe-inline'

Verification

deno test -A packages/fresh/src/middlewares/csp_test.tsx — 12 passed, 0 failed