feat: improve security headers and csp nonce handling

direct.php

@@ -50,7 +50,7 @@ $liveStream = getLiveStream();
     <meta name="twitter:image" content="<?php echo getBaseUrl(); ?>/img/logo.png">
     
     <!-- Données structurées JSON-LD pour la page direct -->
-    <script type="application/ld+json">
+    <script type="application/ld+json" nonce="<?php echo getCspNonce(); ?>">
     {
         "@context": "https://schema.org",
         "@type": "WebPage",
@@ -85,7 +85,7 @@ $liveStream = getLiveStream();
     ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -163,7 +163,7 @@ $liveStream = getLiveStream();
                             $bgImageStyle = 'background-image: url(\'' . htmlspecialchars(NEXT_LIVE_IMAGE) . '\');';
                         }
                         ?>
-                        <div class="next-live-announcement" style="<?php echo $bgImageStyle; ?>">
+                        <div class="next-live-announcement" style="<?php echo $bgImageStyle; ?>" nonce="<?php echo getCspNonce(); ?>">
                             <?php if (!empty(NEXT_LIVE_IMAGE) && file_exists(NEXT_LIVE_IMAGE)): ?>
                                 <div class="next-live-image-container">
                                     <img src="<?php echo htmlspecialchars(NEXT_LIVE_IMAGE); ?>"