Inline styles are blocked by Content Security Policy (csp)

Problem/Motivation

This module adds inline styles, which is not supported when using CSP with the style-src directive.

Content-Security-Policy: (Report-Only policy) The page’s settings would block an inline style (style-src-elem) from being applied because it violates the following directive: “style-src * 'report-sample'”. Consider using a hash ('sha256-dd4J3UnQShsOmqcYi4vN5BT3mGZB/0fOwBA72rsguKc=', requires 'unsafe-hashes' for style attributes) or a nonce.

Proposed resolution

Add a nonce provided by the csp module, if installed.