feat: write cspNonce to style tags

[thebanjomatic]

Description

Split off from #16415. This PR will set the nonce attribute for any inline <style> tags in the html if html.cspNonce is set. This probably shouldn't be merged until #16415 gets merged to avoid writing a second nonce attribute for any existing <style nonce=""> tags, otherwise this change would be breaking.

See comment from @sapphi-red

While I was working on #16052, I was thinking hard about what tags should have the nonce attribute injected. The first idea was to only inject tags that cannot be achieved by chaning the input HTML (e.g. <script type="module">). The second idea was to inject it into all tags that CSP allows using nonce (e.g. <script>, <style>). When I did that commit, I decided to go with the first idea. The reason was because I wasn't sure the whole list of tags that needs the nonce attribute to be set and another reason was because I thought it's easy to add it later rather than removing it. But it seems I forgot to skip injecting nonce attributes to script tags without type=module.

On second thought, I think it makes sense to go with the second idea. Vite already injects the nonce to <script>, , , . If I understand the CSP spec correctly, the only missing tag is the <style> tag.

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[sapphi-red]

Thank you! Would you update this part as well?
https://vitejs.dev/guide/features.html#content-security-policy-csp:~:text=When%20html.cspNonce%20is%20set%2C%20Vite%20adds%20a%20nonce%20attribute%20with%20the%20specified%20value%20to%20the%20output%20script%20tag%20and%20link%20tag%20for%20stylesheets.%20Note%20that%20Vite%20will%20not%20add%20a%20nonce%20attribute%20to%20other%20tags%2C%20such%20as%20%3Cstyle%3E.

[sapphi-red]

/ecosystem-ci run

[vite-ecosystem-ci]

📝 Ran ecosystem CI on 96353ba: Open

suite	result	latest scheduled
nuxt	✅ success	❌ failure

✅ analogjs, astro, histoire, ladle, laravel, marko, previewjs, quasar, qwik, rakkas, remix, sveltekit, unocss, vike, vite-plugin-pwa, vite-plugin-react, vite-plugin-react-pages, vite-plugin-react-swc, vite-plugin-svelte, vite-plugin-vue, vite-setup-catalogue, vitepress, vitest

[patak-dev]

@thebanjomatic would you resolve the conflicts? We discussed about this in the last team meeting and it was decided to move forward with it in a patch.

[thebanjomatic]

@patak-dev conflicts are resolved now. Thanks!