Add rename_csp_helper_nonce_attribute ActionView configuration to avoid value exfiltration

[codergeek121]

Adds a configuration to rename the CSP helper attribute name to avoid value exfiltration as described in #51580 (comment)

It's disabled by default currently until the JS libraries are updated to the new attribute name and Rails can ship with a new default attribute name.

Fixes the Rails part #51580. See this PR for a potential fix in Turbo: https://github.com/hotwired/turbo/pull/1254/files

If this approach makes sense in general, I'd try to fix ujs as well 👍

[codergeek121]

I added a commit to change UJS as well. It changes UJS to check for the nonce attribute first, and if absent falls back to the content attribute.

[skipkayhil]

UJS is dead #50535, so those files should not be changed

[codergeek121]

I removed the UJS changes, thank you for the hint!

Since main now target Rails 8, I could also remove the configuration flag and default to the nonce attribute instead. This would be a breaking change. Note that Turbo & Trix would work with both attributes after hotwired/turbo#1254 & basecamp/trix#1151.

I'd be happy to adapt 👍

[zzak]

Since main now target Rails 8, I could also remove the configuration flag and default to the nonce attribute instead.

Even with a major version, we still have to follow the deprecation cycle.

[codergeek121]

Thank you for the link/info @zzak!

Can we still deprecate this in 7.2, or should we deprecate this in 8.0?

There's no new_framework_defaults_8_1.rb.tt and corresponding case statement yet, I can take a look into creating it though, but maybe this should happen in a separate PR?