Revert "perf: make root HTML cacheable by dropping per-request CSP nonce"

This reverts commit 522bf6a019.

proxy.ts

@@ -5,11 +5,12 @@ import { routing } from "./i18n/routing";
 const intlMiddleware = createIntlMiddleware(routing);
 
 export function proxy(request: NextRequest) {
+  const nonce = crypto.randomUUID();
   const isDev = process.env.NODE_ENV === "development";
 
   const scriptSrc = isDev
-    ? `'self' 'unsafe-eval' blob:`
-    : `'self' blob:`;
+    ? `'self' 'nonce-${nonce}' 'unsafe-eval' blob:`
+    : `'self' 'nonce-${nonce}' blob:`;
 
   const connectSrc = isDev ? `'self' https: ws: wss:` : `'self' https:`;
 
@@ -51,6 +52,13 @@ export function proxy(request: NextRequest) {
   }
   const response = intlResponse ?? NextResponse.next();
 
+  const existing = response.headers.get("x-middleware-override-headers");
+  response.headers.set(
+    "x-middleware-override-headers",
+    existing ? `${existing},x-nonce` : "x-nonce"
+  );
+  response.headers.set("x-middleware-request-x-nonce", nonce);
+
   response.headers.set("X-Content-Type-Options", "nosniff");
 
   // X-Frame-Options only supports DENY/SAMEORIGIN. When frame-ancestors