Actually, you would not use the
wp_head action. That happens in the head part of the HTML output. To send a Content-Security-Policy header, or modify an existing one, you would want to hook into the
wp_headers filter instead.
As for generating the nonce, you don't want to use a WordPress based nonce, as those are not unique per page load. You will want each load to have a random number generated.
As for using the same number in the
wp_headers and the
script_loader_tag, well, you just, you know, use the same number in both places. Generate the number in the body of your plugin code, put it in a global variable, then reference that variable from both functions hooked to those filters.