Get rid of `unsafe-inline` in content security policy

[jaylinski]

This affects the calculateProgress function inside the controls.js view, which uses inline styles.