We expect that styles and scripts rendered in the admin
dashboard will not be filterable, so only supply a
CSP for the front-end.

So we can use it with a CSP.

And add a nonce to all enqueued scripts.

In preparation for removing gravatar.com from the CSP.

Chore/tighten content security policy

Make addContentSecurityPolicy solely responsible for deciding
when to add a CSP to a page. Applies SRP.

Previously a bug in the implementation of is_login() caused
CSPs to be omitted for any page which partially matched the
path '/wp-login.php' including '/'.

Now, we work around that by checking SCRIPT_NAME in the
superglobal directly.

See:
    https://core.trac.wordpress.org/ticket/63896#ticket

Fix/front page should have csp