Support Content-Security-Policy nonce when outputting a script tag

[shockie]

this Gem currently doesn't support a Content-Security-Policy based on nonces, as it outputs the script tag without the nonce which results in the browser rejecting to execute the mixpanel script.

This PR will gracefully check if the request has a nonce in the environment and attaches it to the script tag when it's present.