Add CSP nonce support to Django profiling pages

[RRXXZZYY]

What

• add a PYINSTRUMENT_CSP_NONCE callback for Django middleware
• apply its HTML-escaped value to both inline scripts in the profiling page
• document that the callback is evaluated once per profiling response and must match the application's CSP header
• add an end-to-end regression test covering callback reuse and attribute escaping

Why

Django applications whose CSP disallows inline scripts currently need to relax script-src to display the profiling page. A per-response nonce lets the application authorize Pyinstrument's two inline scripts without enabling unsafe-inline.

Closes #306.

Verification

• regression test fails before the implementation because the nonce callback is never called, then passes after the change
• pytest -q through a temporary ASCII path alias on Windows: 133 passed, 11 skipped (with one Trio signal-handling warning)
• prek run --all-files: passed (ruff, formatting, codespell, pyright, repository hooks, and JS bundle rebuild)
• remote branch compared byte-for-byte with the reviewed local blobs; the PR contains one commit and four changed files

Unverified boundaries

• I did not exercise this against a deployed Django application with a live CSP header in a browser.
• Pyinstrument does not generate the nonce or modify the CSP header; the host application must supply and authorize the same nonce.

AI assistance

AI assistance was used to investigate, implement, test, and review this change. The final diff and generated artifacts were checked, and all verification results above are from commands actually run.