Add 'self' to CSP script-src directive only when strictly necessary

[castarco]

As of today, Astro-Shield always adds the 'self' source to avoid potential problems with static imports present inside loaded scripts.

Although this is not dangerous, it is arguably less safe than just adding the hashes of the specific resources that will be loaded, and it is not always necessary (loaded scripts not always have static imports inside them, which is the only reason to add the self source).

My proposal is to detect when those import statements are present in the loaded scripts, and then add the self source only in those cases.