docs: explain the CSP nonce model across client-router soft navigations

[vivek7405]

Closes #1054

Documents the one genuinely subtle, security-relevant part of the CSP story that the docs skipped: how the nonce behaves across a client-router soft navigation.

What's added

• docs/app/docs/security/page.ts: a "CSP and the client router" subsection under the existing CSP section, covering (a) enforcement is the HTTP Content-Security-Policy header, not a <meta http-equiv> tag (so frame-ancestors / report-uri work), and the <meta name="csp-nonce"> is only a client-side carrier; (b) on a soft nav the original page-load nonce stays authoritative and the router re-stamps every dynamically-inserted script/preload with it via getCspNonce() (fix: view-transition soft-nav meta leak and stuck Suspense skeleton #1049/fix: preserve csp-nonce on mergeHead, warn on dropped streamed resolve #1052); (c) no user config needed, and CSP pages are cache-excluded so a nonce is never replayed stale.
• .agents/skills/webjs/references/built-ins.md: a matching paragraph in the CSP section.

Grew out of an analysis of whether the meta csp-nonce approach needed changes. It does not, the code was already correct, only the docs were silent.

Definition of done

• Docs-only, no code change. Both doc surfaces (docs site + agent-docs reference) updated and kept consistent.
• Tests: N/A because docs-only (no behavior change; the described behavior is already tested by fix: view-transition soft-nav meta leak and stuck Suspense skeleton #1049/fix: preserve csp-nonce on mergeHead, warn on dropped streamed resolve #1052's suites).
• Dogfood: docs app boots and /docs/security serves 200 with the new subsection present.
• Accuracy verified against the code (header enforces via csp.js buildCspHeader; the carrier meta is emitted in ssr.js; the client re-stamps via getCspNonce() / cloneScriptWithCorrectNonce / reactivateScripts; cache-excluded in html-cache.js).

[vivek7405]

Checked the prose against the code, all the mechanism claims hold. One overstatement: it said the original nonce stays authoritative for the whole session, which reads as if it survives a reload. It only holds for the life of the current document. Fixed, and added the harmless full-load case so the soft-nav vs hard-reload line is explicit.

[vivek7405]

Re-read the soft-nav paragraph after the rewording. The document-scoped claim is accurate, the full-load case is spelled out, and it is consistent with the built-ins reference. Good to go.