Allow passing a function to `:content-security-policy`

[p-himik]

As far as I understand, in order for WebSockets to work, you should specify something like wss://example.com in the CSP header. Right now, you can either specify the wss: wildcard or write your own interceptor.

[jdf-id-au]

This would also be helpful for generating a dynamic nonce.