Summary

Until now, the AJAX script transport only used a script tag to load scripts
for cross-domain requests or ones with scriptAttrs set. This commit makes
it also used for all async requests to avoid CSP errors arising from usage
of inline scripts. This also makes jQuery.getScript not trigger CSP errors
as it uses the AJAX script transport under the hood.

For sync requests such a change is impossible and that's what jQuery._evalUrl
uses. Fixing that is tracked in gh-1895.

The commit also makes other type of requests using the script tag version of the
script transport set its type to "GET", namely async scripts & ones with
scriptAttrs set in addition to the existing cross-domain ones.

Fixes gh-3969

Checklist

• All authors have signed the CLA at https://cla.js.foundation/jquery/jquery
• New tests have been added to show the fix or feature works
• Grunt build and unit tests pass locally with these changes
• If needed, a docs issue/PR was created at https://github.com/jquery/api.jquery.com