Add the 'unsafe-hash-attributes' source expression.

This source expression allows hashes to match both event handlers and inline
style attributes.

Closes w3c/webappsec-csp#13.
Closes w3c/webappsec-csp#40.

Author: ryandel8834