Widget: use the script tag's CSP nonce when init() is called without one #485

Follow-up to #473. Under a strict CSP, the widget's styles need the page's nonce. A script-tag install reads it from its own <script nonce> when it starts itself from data-* attributes (packages/widget/src/script-config.ts). But a site that loads the script tag and then calls ChatCops.init({ ... }) itself, which is common, has to pass nonce again. If it doesn't, the widget loads unstyled under that policy.

What to do

• In the loader (packages/widget/src/loader/loader.ts), read document.currentScript?.nonce once when the script runs (it's only set during the script's first run), and use it when the config passed to init() leaves nonce out.
• Do the same for the single-file build (packages/widget/src/index.ts).
• An explicit nonce in the config still wins.

Acceptance criteria

• Unit tests: the script's nonce is used when init() has none, an explicit one wins, and a script without a nonce changes nothing
• Extend the CSP e2e test (e2e/tests/loader.spec.ts, the nonce test) so ChatCops.init({ apiUrl }) without nonce still passes with no violations
• A sentence in the Content Security Policy section of website/src/content/docs/widget/configuration.mdx
• A patch changeset for @chatcops/widget; pnpm test:coverage, pnpm lint and pnpm size pass

Comment here to be assigned.