Compute Content-Security-Policy hashes for inline JS (#10504)

* Split out inline JS from index/init templates to separate files

* Read inline JS from resources at run time

* Calculate inline JS hashes for CSP header from content

* Move inline JS to resource sub-directory

* Update and memoize inline JS loading

* Revert debug code

* Deduplicate `resp/response` calls

* Fix paths to moved inline JS resources

* Force creation of test data DB so things don't get left in the cache

This fix was provided by @camsaul.

* Combine and `defonce` inline JS hashes

* s/inlinejs/inline-js/