Fix Plausible CSP violations with strict-dynamic

Add CSP nonces to Plausible script tags and stop fragment-caching the
partial so nonces stay per-request. Remove unused plausible.io host
allowlist from script-src since strict-dynamic ignores host sources.

Author: pglombardo

app/views/application/_plausible.html.erb

@@ -1,6 +1,6 @@
 <% if ENV.key?('PLAUSIBLE_DOMAIN') && Rails.env == "production" %>
-  <script async src="https://plausible.io/js/<%= ENV['PLAUSIBLE_DOMAIN'] %>.js"></script>
-  <script>
+  <script nonce="<%= request.content_security_policy_nonce %>" async src="https://plausible.io/js/<%= ENV['PLAUSIBLE_DOMAIN'] %>.js"></script>
+  <script nonce="<%= request.content_security_policy_nonce %>">
     window.plausible=window.plausible||function(){(plausible.q=plausible.q||[]).push(arguments)},plausible.init=plausible.init||function(i){plausible.o=i||{}};
     plausible.init()
   </script>

app/views/layouts/application.html.erb

@@ -11,7 +11,7 @@
   <%= render partial: "shared/layout_icons", cached: true %>
 
   <%= render partial: "application/ga", cached: true %>
-  <%= render partial: "application/plausible", cached: true %>
+  <%= render partial: "application/plausible" %>
 
   <%= csrf_meta_tags %>
   <%= csp_meta_tag if defined?(csp_meta_tag) %>

app/views/layouts/bare.html.erb

@@ -11,7 +11,7 @@
   <%= render partial: "shared/layout_icons", cached: true %>
 
   <%= render partial: "application/ga", cached: true %>
-  <%= render partial: "application/plausible", cached: true %>
+  <%= render partial: "application/plausible" %>
 
   <%= csrf_meta_tags %>
   <%= csp_meta_tag if defined?(csp_meta_tag) %>

app/views/layouts/login.html.erb

@@ -11,7 +11,7 @@
   <%= render partial: "shared/layout_icons", cached: true %>
 
   <%= render partial: "application/ga", cached: true %>
-  <%= render partial: "application/plausible", cached: true %>
+  <%= render partial: "application/plausible" %>
 
   <%= csrf_meta_tags %>
   <%= csp_meta_tag if defined?(csp_meta_tag) %>

app/views/layouts/naked.html.erb

@@ -11,7 +11,7 @@
   <%= render partial: "shared/layout_icons", cached: true %>
 
   <%= render partial: "application/ga", cached: true %>
-  <%= render partial: "application/plausible", cached: true %>
+  <%= render partial: "application/plausible" %>
 
   <%= csrf_meta_tags %>
   <%= csp_meta_tag if defined?(csp_meta_tag) %>

config/initializers/content_security_policy.rb

@@ -13,9 +13,7 @@
     policy.img_src :self, :https, :http, :data, :blob
     policy.media_src :self, :https, :http, :data, :blob
     policy.object_src :none
-    script_src = [:strict_dynamic, :self, :https, :http]
-    script_src << "https://plausible.io" if ENV.key?("PLAUSIBLE_DOMAIN")
-    policy.script_src(*script_src)
+    policy.script_src :strict_dynamic, :self, :https, :http
     policy.style_src :self, :https, :http, :unsafe_inline
     policy.style_src_attr :unsafe_inline
     policy.connect_src :self, :https, :http, :ws, :wss