fix: only add nonce to script-src-elem, style-src-attr and style-src-elem CSP directives when unsafe-inline is not present (#11613)
script-src-elem
style-src-attr
style-src-elem
unsafe-inline
fix: support HTTP/2 in dev and production. Revert the changes from #12907 to downgrade HTTP/2 to TLS as now being unnecessary (#12989)