Nonce support for CSP

Right now [secure.go](https://github.com/fragmenta/mux/blob/master/middleware/secure/secure.go) supports whitelisting source as part of CSP adding [nonce-*](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#other_values) can help adding img files used by scripts in script-src even if the script itself didn't implement proper CSP.