Add a nonce to link preload tags, allow blob: and data: in worker-src
and allow snowplow connect-src when it's configured

Changelog: fixed