[JENKINS-71047] Deprecate inline JS event handlers (#8061)

Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
Co-authored-by: Yaroslav Afenkin <yaroslavafenkin@users.noreply.github.com>
Co-authored-by: Tim Jacomb <21194782+timja@users.noreply.github.com>

Author: 3 people

core/src/main/resources/lib/form/readOnlyTextbox.jelly

@@ -62,6 +62,20 @@ THE SOFTWARE.
       If @field is specified, this will be inferred automatically,
       which is the recommended approach.
     </st:attribute>
+    <st:attribute name="onchange" deprecated="true">
+      Inline JavaScript to execute when the textbox is changed.
+      Deprecated because this attribute is incompatible with adding Content-Security-Policy to the Jenkins UI in the future.
+      Set 'id' or 'clazz' attributes as appropriate to look up this element in external Javascript files (e.g. adjuncts)
+      to add the desired behavior there (DOMContentLoaded event in static forms, Behaviour.specify if this element may be
+      dynamically added). See https://github.com/jenkinsci/jenkins/pull/6852 for an example.
+    </st:attribute>
+    <st:attribute name="onkeyup" deprecated="true">
+      Inline JavaScript to execute when the keyup event is fired.
+      Deprecated because this attribute is incompatible with adding Content-Security-Policy to the Jenkins UI in the future.
+      Set 'id' or 'clazz' attributes as appropriate to look up this element in external Javascript files (e.g. adjuncts)
+      to add the desired behavior there (DOMContentLoaded event in static forms, Behaviour.specify if this element may be
+      dynamically added). See https://github.com/jenkinsci/jenkins/pull/6852 for an example.
+    </st:attribute>
   </st:documentation>
   <f:prepareDatabinding />
   <input class="jenkins-input ${attrs.checkUrl!=null?'validated':''} ${attrs.clazz}"