Allow Content Security Policy without "script-src data:"

In Content Security Policies (CSP), the data: directive of script-src can be considered insecure - similar to usages of unsafe-eval and unsafe-inline.

While WEBUI-60 allows for the removal of unsafe-eval and unsafe-inline from the CSP by disabling org.nuxeo.web.ui.expressions.eval, this does not prevent browser errors from occurring when the data: directive is removed. There should be a mechanism to allow Polymer scripts to execute without the need for this policy directive.

Steps to Reproduce:

1. Set the following contribution (via XML extension or configuration template):

<require>org.nuxeo.ecm.platform.web.common.requestcontroller.service.RequestControllerService.defaultContrib</require>
<extension target="org.nuxeo.ecm.platform.web.common.requestcontroller.service.RequestControllerService" point="responseHeaders">
   <header name="Content-Security-Policy">default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: www.nuxeo.com; font-src * data:; media-src 'self'; frame-src 'self'; frame-ancestors 'self'; object-src 'none';</header>
</extension>

<extension target="org.nuxeo.runtime.ConfigurationService" point="configuration">
   <property name="org.nuxeo.web.ui.expressions.eval">false</property>
</extension>

2. Login to the instance via Web UI

Expected behavior: nuxeo-home loads; page is traversible

Actual behavior: nuxeo-home is blank; several errors outputted in the browser console (see screenshot).