feat: add nonce support for inline style and script tags in CSP

[bartlomieju]

Supersedes #1787.

Summary

• Auto-inject nonce attribute onto inline <script> and <style> tags during server rendering
• Add useNonce option to the CSP middleware that replaces 'unsafe-inline' with per-request 'nonce-{value}' directives
• Expose render nonce via X-Fresh-Nonce response header (internal, stripped by CSP middleware)

Usage

app.use(csp({ useNonce: true }));

This locks down the CSP policy so only Fresh-rendered inline scripts/styles are allowed. Each request gets a unique nonce.

How it works

1. During SSR, the Preact vnode hook injects nonce={RENDER_STATE.nonce} onto all <script> and <style> elements (unless they already have an explicit nonce)
2. After rendering, ctx.render() sets X-Fresh-Nonce on the response
3. The CSP middleware (when useNonce: true) reads the nonce, replaces 'unsafe-inline' with 'nonce-{value}' in script-src and style-src, and strips the internal header

Test plan

• Nonce replaces unsafe-inline in CSP header (script-src and style-src)
• Nonce injected on inline <script> tags
• Nonce injected on inline <style> tags
• Non-rendered responses (API routes) fall back to unsafe-inline
• Unique nonce per request
• Existing explicit nonce attribute preserved
• All 3 original CSP tests still pass
• deno fmt and deno lint clean

🤖 Generated with Claude Code