Fix for ignored CSP_NONCE in ContentSecurity Header

[HolgerHees]

We should use 'cspNonceManager' for requesting the NONCE value, because it is doing the same as before, except that it honors a CPS_NONCE environment variable if available.

If a CSP_NONCE env var is defined, it is used nearly everywhere, except for setting the correct ContentSecurityPolicy Header.

This commit fixes this.

[susnux]

Looks good!
But then we can remove csrfTokenManager from the class as it is no longer used.

[susnux]

There might be a problem because all our webpack loaded scripts use the csrf token as nonce -> will break if you use a custom nonce. But we should fix that.

[HolgerHees]

There might be a problem because all our webpack loaded scripts use the csrf token as nonce -> will break if you use a custom nonce. But we should fix that.

@susnux it looks like my change will be merged in version 30.0.0. Is the problem, you mentioned solved?

[susnux]

There might be a problem because all our webpack loaded scripts use the csrf token as nonce -> will break if you use a custom nonce. But we should fix that.

For this issue I pushed a commit to provide the CSP nonce as <meta name="csp-nonce"> important to notice is that we can not use content because this can lead to side-channel exfiltration attacks (e.g. using CSS selectors like meta[content~=...]) but we need to use the nonce attribute as this can not be queried by selectors and only accessed using JS like element.nonce.

Ref: https://html.spec.whatwg.org/multipage/urls-and-fetching.html#nonce-attributes

---

If we approve this PR then we should go with this: nextcloud-libraries/nextcloud-auth#673