[NEW] Content-Security-Policy for inline scripts

[ggazzo]

Closes #19815

Proposed changes (including videos or screenshots)

Security policies were applied for inline scripts cases. Due to the libraries and components we use it is not possible to disable inline styles and images as they would break Oembeds and other libraries.

basically the inline scripts were moved to a js file

and besides that some suggars syntax like addScript and addStyle were added, this way the application already takes care of inserting the elements and providing the content automatically.

Issue(s)

Steps to test or reproduce

Further comments

[DocDocTeam]

Updated to 3.16. There was an error Content-Security-Policy
"Refused to load the script 'https://lib.usedesk.ru/secure.usedesk.ru/widget_111111.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback."

While disabled in the general settings Content-Security-Policy.
The documentation is empty https://github.com/RocketChat/docs/blob/master/guides/administration/administration/settings/setup-wizard.md

1. You write "basically the inline scripts were moved to a js file" - in which one?
2. How do I whitelist my script?