Replace 'nonce' with 'self' in CSP default rules (#31610)

Edge doesn't support nonce for src scripts due to a bug in the browser,
and while it's not a supported browser for Kibana, we'd like to avoid
surprises for people that are upgrading between minor versions.

src/server/csp/index.test.ts

@@ -34,7 +34,7 @@ import { createCSPRuleString, DEFAULT_CSP_RULES, generateCSPNonce } from './';
 test('default CSP rules', () => {
   expect(DEFAULT_CSP_RULES).toMatchInlineSnapshot(`
 Array [
-  "script-src 'unsafe-eval' 'nonce-{nonce}'",
+  "script-src 'unsafe-eval' 'self'",
   "worker-src blob:",
   "child-src blob:",
 ]

src/server/csp/index.ts

@@ -23,7 +23,7 @@ import { promisify } from 'util';
 const randomBytesAsync = promisify(randomBytes);
 
 export const DEFAULT_CSP_RULES = Object.freeze([
-  `script-src 'unsafe-eval' 'nonce-{nonce}'`,
+  `script-src 'unsafe-eval' 'self'`,
   'worker-src blob:',
   'child-src blob:',
 ]);