Propagate CSP nonce to StyleInjector elements

[frank70321-hub]

StyleInjector creates inline <style> elements for CssResource and GssResource output. Under a nonce-based style-src Content Security Policy, those elements need the page's nonce to be accepted.

This change mirrors the existing ScriptInjector behavior: when the current document contains a script[nonce], StyleInjector copies that nonce to each newly created style element. If no nonce source exists, the injected style element is left unchanged.

The focused HtmlUnit coverage verifies both paths:

• a style element inherits an existing script nonce;
• no nonce attribute is created when the document has no nonce source.

Local verification:

• StyleInjectorTest: 6 tests, 0 failures, 0 errors;
• user source and test checkstyle: 0 violations in the changed files;
• ant buildonly: successful;
• git diff --check: successful.

This addresses the nonce option only; the hash-based option discussed in the issue remains separate.

Partial #9990

[niloc132]

I think this looks right - if some other script can read the nonce and assign to its own scripts/stylesheets then by definition that other script can already run and is unsafe to begin with.

This doesn't guarantee the safety of the stylesheet being injected though - StyleInjector will happily take a string from the URL (query params etc) even if entirely unsafe. That's the only thing I would feel nervous about here, that we could be implying that the script is known to be safe.

Off the top of my head, we could make this configurable (e.g. ignore, propagate-nonce, the-nonce-is-this-string), or add another overload for inject to specify the nonce (doesn't help css resource cases though). I think this could be worth more discussion in the issue prior to implementation.

[frank70321-hub]

Agreed. The nonce only lets the generated style pass nonce-based CSP; it does not make an untrusted CSS string safe, and the default behavior should not imply otherwise.

I summarized ignore, automatic propagation, and explicit/configured nonce options in #9990, including the CssResource limitation of an overload-only approach. I have paused implementation changes until the intended API shape and default behavior are decided there.