React version: 18.1.0-next-af730436c-20220405

## Steps To Reproduce
1. Use server with CSP script-src set to strict-dynamic and with nonce.
2. Use renderToPipeableStream and add nonce to its options. Pass js client assets through bootstrapScripts.
3. Launch development server and try to load app.

## The current behavior
The renderToPipeableStream nonce is only applied to inline scripts (bootstrapScriptContent) in createResponseState().

## The expected behavior
A strict-dynamic script-src CSP applies to both inline scripts and scripts with src. I would expect the nonce to also be applied to scripts with src. The change seems simple enough .The createResponseState() would look like this:

```JS
  var startScriptSrcWithNonce = nonce === undefined ? startScriptSrc : stringToPrecomputedChunk('<script nonce="' + escapeTextForBrowser(nonce) + '" src="');
  var startModuleSrcWithNonce = nonce === undefined ? startModuleSrc : stringToPrecomputedChunk('<script nonce="' + escapeTextForBrowser(nonce) + '" type="module" src="');

  ...
  if (bootstrapScripts !== undefined) {
    for (var i = 0; i < bootstrapScripts.length; i++) {
      bootstrapChunks.push(startScriptSrcWithNonce, stringToChunk(escapeTextForBrowser(bootstrapScripts[i])), endAsyncScript);
    }
  }

  if (bootstrapModules !== undefined) {
    for (var _i = 0; _i < bootstrapModules.length; _i++) {
      bootstrapChunks.push(startModuleSrcWithNonce, stringToChunk(escapeTextForBrowser(bootstrapModules[_i])), endAsyncScript);
    }
  }
```

Please let me know if I am missing the reason why this was not implemented.
integrity: 'garply',
            },
          ],
        },
      );
      pipe(writable);
    });
    expect(getVisibleChildren(document)).toEqual(
      <html>
        <head />
        <body>
          <div>hello world</div>
        </body>
      </html>,
    );
    expect(
      stripExternalRuntimeInNodes(
        document.getElementsByTagName('script'),
        renderOptions.unstable_externalRuntimeSrc,
      ).map(n => n.outerHTML),
    ).toEqual([
      '<script src="foo" async=""></script>',
      '<script src="bar" async=""></script>',
      '<script src="baz" integrity="qux" async=""></script>',
      '<script type="module" src="quux" async=""></script>',
      '<script type="module" src="corge" async=""></script>',
      '<script type="module" src="grault" integrity="garply" async=""></script>',
    ]);
  });
  describe('bootstrapScriptContent escaping', () => {