Add support for strict Content Security Policy

[Dosenpfand]

To support the usage of Boostrap-Flask together with a strict Content Security Policy (CSP), to have a defense in depth against XSS attacks, the following changes have been made:

1. Remove inline style declarations, use classes instead
2. Remove inline JS, use HTML + CSS instead
3. Add support of nonces with JS includes
4. Add basic usage documentation

If desired I can still add an example and/or test case for this use case.

[greyli]

Thanks for working on this. Please add tests and update the changelog.

[Dosenpfand]

Thanks for the feedback. I added the changelog entry, added tests and fixed the 2 findings.

[greyli]

Merged, thanks!