Fix CSP nonce handling for Turbo Stream scripts

[tubaxenor]

Summary

• StreamElement.templateContent clones template content via cloneNode(true), but browsers hide nonce attribute values after HTML parsing (Chrome nonce hiding). The cloned scripts have nonce="" and get blocked by CSP's script-src-elem directive. Fix: activate scripts in the cloned content using activateScriptElement, consistent with how FrameRenderer and ErrorRenderer already handle scripts.

• activateScriptElement sets the CSP nonce before copyElementAttributes, which then overwrites it with an empty string (from the source element's hidden nonce). Fix: move nonce assignment after copyElementAttributes.

Related upstream issues

• Function activateScriptElement overwrite CSP nonce with empty string causing violation hotwired/turbo#1502 — activateScriptElement overwrites CSP nonce
• Fix activateScriptElement to set the CSP nonce correctly hotwired/turbo#1503 — Open PR for the copyElementAttributes ordering fix
• Unable to run inline JavaScript from a Turbo Stream when CSP is enabled hotwired/turbo-rails#481 — Inline JS in Turbo Streams blocked by CSP

Test plan

• Existing stream script test (receiving a message with a <script> element) continues to pass
• Verify in a Rails app with CSP nonce-based script-src-elem that inline scripts in Turbo Stream responses execute without CSP violations

🤖 Generated with Claude Code