Inline JavaScript/CSS should not be used

[Alanaktion]

To properly implement the Content-Security-Policy header, we should remove any inline JavaScript and CSS (including style attributes) as they are far more likely to be injected by a malicious user than an external script file or stylesheet is.