Preload link tags need the CSP nonce added if the policy is configured
with a nonce, otherwise browsers won't load these resources.
At least Chrome also requires the nonce attribute in the HTTP Link
header.