expose `getNonce()` in plugins

[Jabolol]

This would allow to create custom Content-Security-Policy headers on the fly inside plugins.

Relevant discussion here