feat: link script in head for CSP 'self' compliance in v3

[dargmuesli]

Is your feature request related to a problem? Please describe.

I'd like to not have any inline scripts to enforce a strict Content Security Policy.

Describe the solution you'd like

The color-mode script should not be inlined as done here

color-mode/src/runtime/nitro-plugin.ts

Line 7 in 65c90d4

htmlContext.head.push(`<script>${script}</script>`)

but instead be an external file that is linked.

Describe alternatives you've considered

Set script-src: 'unsafe-inline' (which is unsafe)

Additional context

This was previously done for Nuxt 2 here:

color-mode/src/runtime/nitro-plugin.ts

Line 7 in 65c90d4

htmlContext.head.push(`<script>${script}</script>`)