How to use CSP with koa-helmet?
With how middleware works in koa, i've found this to be surprisingly difficult. It was pretty easy to do in express, via locals, but I can't quite get it to work in koa. Am I missing something obvious here?

```
app.use(async (ctx, next) => {
    console.log('ctx.state => ', ctx.state); // { nonce: validNonceHere }
    return koaHelmet.contentSecurityPolicy({
      directives: {
        defaultSrc: ["'self'"],
        frameAncestors: ["'none'"],
        objectSrc: ["'none'"],
        reportUri: '/report-violation',
        scriptSrc: [
          "'self'",
          ' ajax.googleapis.com',
          `'nonce-${ctx.state.nonce}'`,
        ],
        upgradeInsecureRequests: true,
      },
      reportOnly: IS_DEV,
    });
  });
```

When I pass in helmet or a helmet function directly, it works fine. When I pass in an async middleware function, in order to access my nonce in state, nothing happens (or it 404s).

I know this isn't a bug or an 'issue', but maybe some clarity in the docs around this could help? 

Thanks