Allow passing a function to :content-security-policy

[p-himik]

As far as I understand, in order for WebSockets to work, you should specify something like wss://example.com in the CSP header.
Right now, you can either specify the wss: wildcard or write your own interceptor.

[jdf-id-au]

This would also be helpful for generating a dynamic nonce.