Do not add signatures if unsafe-inline is enabled

[fritzmg]

Currently signatures are explicitly still added, even if unsafe-inline was already present in the script-src or style-src directive. However, if your application adds a lot of hashes (for style="…" for example) and you decide to instead allow unsafe-inline in general, the hashes are still output in the response header. This might lead to the response header size being too large, if there are a lot of long hashes for example

This PR would automatically not apply any signatures, if unsafe-inline was enabled.

wdyt?

[Seldaek]

This is risky IMO, because if you use signatures then unsafe-inline will be ignored by modern browsers supporting CSP2. It's merely there as a fallback.

Now with your change suddenly having unsafe-inline in an existing config would silently break/remove signatures.

I think the more appropriate way is to disable the hash functionality if you are not interested in outputting hashes.