fix(CSP): nonce support

[maccuaa]

Description

Currently, if you include a nonce attribute on script or style tags in your html file, Vite will strip it out. See discussion #5218

This PR adds a new build option for specifying a nonce placeholder. If specified, script and link tags will include the nonce placeholder in the generated HTML. This allows applications to support nonces in their Content Security Policy.

Fixes #9719

The downside of this PR is it includes yet another option to the build config which goes against the Think Before Adding Yet Another Option
section of the PR guide.

Ideally, this could be achieved by just not stripping out the nonce tag building your app.

Related PRs

• fix: add style nonce to comply with content security policy (fix #11862) #11864 (this appears to only fix style tags in Dev mode)

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines.
• Read the Pull Request Guidelines and follow the PR Title Convention.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Ideally, include relevant tests that fail without this PR but pass with it.

[holtolee]

@maccuaa hello, can you resolve conflicts and this

to maybe merge faster ? 🤔

Thank you for your work 👌🏻

[maccuaa]

@maccuaa hello, can you resolve conflicts and this

to maybe merge faster ? 🤔

Thank you for your work 👌🏻

Done!