CSP Test Page — WITH nonce on script but without passing the attribute (should not work without CSP violations)