CSP: Improve warning for missing 'unsafe-hashes'

Content Security Policy does not check hashes against event handlers,
style attributes and javascript: navigations unless the
'unsafe-hashes' keyword is present. The previous warning message was
very confusing, since it was just complaining about a hash not being
specified in the CSP while it was there. Let's tell the developer
explicitly if the 'unsafe-hashes' keyword is needed.

Fixed: 1158193
Bug: 1158193
Change-Id: I966655715a171f5b2792c10e3ef781a363a0a87a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2745138
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#861119}