Feature Request: adding insecureUnsafeInline property to CSP middleware #3813

Currently, nonce-based CSP middleware trims unsafe-inline value specified by the user.

https://github.com/denoland/fresh/blob/39b5f06f8a7d7fa02dd2e2950f2291d04ef9fea7/packages/fresh/src/middlewares/csp.ts#L126-L128

This is ideal from a security standpoint. However, in real-world workloads, it may be necessary to inline style-src or use unsafe-inline for script-src as a fallback for older browsers.

For example, major sites like YouTube also specify unsafe-inline.

% curl -sI https://www.youtube.com/ | grep -i "content-security-policy" | tr ';' '\n'
content-security-policy: require-trusted-types-for 'script'
content-security-policy: base-uri 'self'
object-src 'none'
script-src 'nonce-DlUyhkt87IXfH56peGtAYQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
report-uri https://csp.withgoogle.com/csp/youtube_main/strict

Therefore, I propose adding a new property called insecureUnsafeInline to the CSP middleware.
The user can explicitly prevent the aforementioned trimming of unsafe-inline value by setting this to true.