Fix speedscope rendering in production

This moves the Speedscope files from the asset pipeline to /public. We
only serve precompiled assets in production and we do not need these to
be compiled.

This also adds a nonce to the inline script tag so that it works when
CSP is enabled and script-src is restricted.