fix: apply nonce to streaming redirect and SPA entry scripts

[birkskyum]

• Closes [Feature/Security]: Convert inline manifest into separate file to improve CSP default settings #1263

Closes the remaining CSP gaps from #1263, so a strict script-src policy no longer needs unsafe-inline.

Two script tags weren't picking up the configured nonce:

• Streaming redirect (server/handler.ts). When a redirect resolves after the shell has flushed, the fallback is a client-side <script>window.location=...</script>. It was emitted without a nonce. Since this string is built as raw HTML rather than JSX, the nonce is escaped on the way in.
• SPA entry script (server/spa/StartServer.tsx). Now passes nonce, matching what the SSR StartServer already did.

Note that the manifest part of #1263 was already fixed: v2 no longer inlines window.manifest, and HydrationScript already receives the nonce via sharedConfig.context.

Verification

Built the bare fixture with { nonce: "..." } plus a route that sets Location after the shell flushes:

[changeset-bot]

🦋 Changeset detected

Latest commit: 3736277

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/start	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[netlify]

✅ Deploy Preview for solid-start-landing-page ready!

Name	Link
🔨 Latest commit	3736277
🔍 Latest deploy log	https://app.netlify.com/projects/solid-start-landing-page/deploys/6a6622af1baa740008909c5f
😎 Deploy Preview	https://deploy-preview-2252--solid-start-landing-page.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/start@2252

commit: 3736277