Update README.md clarifying Content Security Policy handling

[Rorymercer]

Having been struggling for several hours to find the cause of why Vue.Draggable needs unsafe-eval as a Content Security Policy I found the comment in the codebase explaining this.

To avoid other users having to do this I suggest that the behaviour of Vue.Draggable in relation to CSP is documented in the list of gotchas already in the documentation.