Add exceptions to Content-Security-Policy

[sethmlarson]

Part of #3041, now that we have reporting in place we can begin ratcheting down the policy based on reports. This PR:

• Uses the constants provided by django-csp for SELF, NONCE, UNSAFE_INLINE.
• Adds exceptions for the domains we use today
• Upgrades all script and style URLs for ajax.googleapis.com to use HTTPS, not the current scheme.
• Adds nonces to the inline scripts included in the base template.

Modernizr unfortunately forces us to use unsafe-inline for style because it unconditionally injects <style> tags into the DOM.