fix(CSP): Add CSP nonce by default and convert browserSupportsCspV3 to blacklist

[susnux]

• Resolves: CSP nonce by default #10207

Summary

Every modern browser ("modern" like every version since 2013 (over 10 years now!)) support the nonce src.
So we should add it by default and only keep a blacklist instead.

This way even users with for us unknown user agents get the more secure version.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[SystemKeeper]

Tested with Talk iOS on iOS 15.5 and 17.0 and both worked for me.

[MichaIng]

Since IE is not (officially) supported by Nextcloud anymore, even the blacklist might not be needed. But good to have the facility, so we can add further entries in the unlikely but possible case that there are other browsers not supporting CSP nonce sources.