feat: improve security headers and csp nonce handling

index.php

@@ -81,7 +81,7 @@ setSecurityHeaders();
     ?>
 
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -679,7 +679,7 @@ setSecurityHeaders();
     <script src="js/mastodon-config.php?v=<?php echo md5(MASTODON_INSTANCE_URL . MASTODON_DATE_FORMAT . MASTODON_BTN_SEE_MORE . MASTODON_BTN_RELOAD . MASTODON_MAX_POST_FETCH . MASTODON_MAX_POST_SHOW); ?>"></script>
 
     <!-- PWA Service Worker -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         if ('serviceWorker' in navigator) {
             window.addEventListener('load', function() {
                 navigator.serviceWorker.register('/sw.js')