Use unsafe_inline as the default for script_src CSP until we get a nonce alternative

Closes #31273 but we will still want to upgrade this to the
nonce-approach when it’s ready.

railties/lib/rails/generators/rails/app/templates/config/initializers/content_security_policy.rb.tt

@@ -9,7 +9,7 @@ Rails.application.config.content_security_policy do |policy|
   policy.font_src    :self, :https, :data
   policy.img_src     :self, :https, :data
   policy.object_src  :none
-  policy.script_src  :self, :https
+  policy.script_src  :self, :https, :unsafe_inline
   policy.style_src   :self, :https, :unsafe_inline
 
   # Specify URI for violation reports