Apparently Mozilla completely spaced out on this when adding the CSP nonce
mechanism, potentially causing web compat issues if scripting relies on
being able to get/set nonces through DOM and/or causing CSP policy check
issues if websites try to "hide" nonces.
This patch implements:
- noModule getter/setter for HTMLScriptElement
- the nomodule attribute for HTMLScriptElement
- the logic in nsScriptLoader that denies the loading of a nomodule script
- tests
Tag #618