Allow reading nonce if it was included in header

[jwhitlock]

If the nonce was generated before the CSP headers were set, then allow reading it with request.csp_nonce.

If the CSP headers were set with no nonce, then continue raising CSPNonceError when reading it as a string. If read as a boolean (if request.csp_nonce), then return False.

This will allow other middleware like django-debug-toolbar to alter the response after the CSP middleware runs, fixing #268.

[jwhitlock]

Thanks @robhudson, I'll add some docs. And maybe another middleware that always generates the nonce...

[jwhitlock]

I added a commit:

• I added CSPMiddlewareAlwaysGenerateNonce, which is like CSPMiddleware, except it always generates a nonce. This could be used when using django-debug-toolbar or similar middlewares.
• I updated nonce.rst with the new behavior of request.csp_nonce, and when to use CSPMiddlewareAlwaysGenerateNonce or other method.
• I updated installation.rst to refer to nonce.rst for more complex init.

I meant to do this over two commits, git fail 🤦

[robhudson]

The CSPMiddlewareAlwaysGenerateNonce gave me pause. But I think some would rather use that in certain situations. The nonce would be added to the header even if not used in the content. I can't see any security implications for this. I actually think this is the generally expected functionality. I think it not being in the header if not used causes some confusion, although I believe it's a nice feature.

I like these changes.