Changes these to use unobtrusive JS

This introduces several changes, but these are all just ported from the
EE project.

This reverts merge request !30808

This adds a notification to let users know of our updated privacy
policy.

Users can dismiss the notification either by following the link or
closing the notification via an "x" icon.

Querying all counts for the different search results in the same request
led to timeouts, so we now only calculate the count for the *current*
search results, and request the others in separate asynchronous calls.

Add support for Content-Security-Policy

Closes #65330

See merge request gitlab-org/gitlab-ce!31402

A nonce-based Content-Security-Policy thwarts XSS attacks by allowing
inline JavaScript to execute if the script nonce matches the header
value. Rails 5.2 supports nonce-based Content-Security-Policy headers,
so provide configuration to enable this and make it work.

To support this, we need to change all `:javascript` HAML filters to the
following form:

```
= javascript_tag nonce: true do
  :plain
    ...
```

We use `%script` throughout our HAML to store JSON and other text, but
since this doesn't execute, browsers don't appear to block this content
from being used and require the nonce value to be present.