Leave a request without a policy when the policy is turned off

With DISABLE_CONTENT_SECURITY_POLICY=true there's no application policy,
and the hash callback started an empty one, so pages sent an empty
Content-Security-Policy header. Skip the callback then.

app/controllers/concerns/inline_script_hashes.rb

@@ -8,7 +8,9 @@ module InlineScriptHashes
   ENTRY_POINT_SCRIPT = %(import "application")
 
   included do
-    content_security_policy do |policy|
+    # With the policy turned off there's nothing to add to, so leave the
+    # request without one rather than starting an empty policy
+    content_security_policy if: -> { request.content_security_policy } do |policy|
       if sources = policy.directives["script-src"]
         importmap = Rails.application.importmap.to_json(resolver: helpers)
         policy.directives["script-src"] = sources | script_origins(importmap) | script_hashes(importmap, ENTRY_POINT_SCRIPT)