[11.0 P1] Update CSP guidance for inline JS removal

[guardrex]

Fixes #36684
Addresses #36448

Wade or Tom ... Just knocking out the hash guidance now that the inline JS will be going away at 11.0.

I agreed (for the most part) with one of Copilot's suggestions and made a change to address it. I didn't agree with the other suggestion.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/blazor/security/content-security-policy.md	aspnetcore/blazor/security/content-security-policy

[Copilot]

Pull request overview

This PR updates the Content Security Policy (CSP) guidance for Blazor to reflect the removal of inline JavaScript in the NavMenu component starting with .NET 11.0. The change eliminates the need for the unsafe-hashes directive and specific hash values that were previously required for the navigation toggler functionality.

Changes:

• Updated generic guidance text for client-side Blazor apps to remove the specific NavMenu example while keeping general unsafe-hashes guidance
• Added new CSP policy example for .NET 11.0+ that excludes the unsafe-hashes directive and hash value
• Adjusted moniker ranges to properly version the CSP examples between .NET 8.0-10.0 and .NET 11.0+