CSP: Allow an option of disabling nonces

CSP: Allow an option of disabling nonces

The current rollout plan calls for initial rollout to only
disallow external JS, and leave removing unsafe inline stuff
to a later date. Thus this adds a useNonces option to the CSP
config to allow that.

Renamed ContentSecurityPolicy::isEnabled() to isNonceRequired
for clarity. The old name has never been in a released version
of MediaWiki, so is removed immediately.

Change-Id: I756d8e97b77c6f97dbbf040a20c8750fecb157c5