fix(security): Add missing CSP nonce attributes to script tags in box_cssjs.php

[Copilot]

Five script tags in fragments/ConsentManager/box_cssjs.php were missing CSP nonce attributes, breaking strict Content Security Policy enforcement.

Changes

Added rex_response::getNonce() to:

• Google Consent Mode v2 script (line 57)
• Debug script and inline config (lines 68, 71)
• Consent manager parameters and frontend script (lines 167-168)

Before:

$consentparams['outputjs'] .= '    <script>var consent_manager_parameters = ' . json_encode($jsConfig) . ';</script>';
$googleConsentModeOutput .= '    <script src="' . $scriptUrl . '" defer></script>';

After:

$consentparams['outputjs'] .= '    <script nonce="' . rex_response::getNonce() . '">var consent_manager_parameters = ' . json_encode($jsConfig) . ';</script>';
$googleConsentModeOutput .= '    <script nonce="' . rex_response::getNonce() . '" src="' . $scriptUrl . '" defer></script>';

Pattern matches 26+ existing nonce implementations across the codebase.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>box_cssjs.php: nonce fehlt</issue_title>
<issue_description>Description / Beschreibung

Zeile 167

$consentparams['outputjs'] .= ' <script>var consent_manager_parameters

da fehlt der/die/das nonce oder?

Affected versions / Verwendete Versionen

5.3.5</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes box_cssjs.php: nonce fehlt #459

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR fixes a critical Content Security Policy (CSP) security issue by adding missing nonce attributes to 5 script tags in fragments/ConsentManager/box_cssjs.php. Without these nonces, strict CSP enforcement was being broken, potentially compromising the security policy of sites using this consent manager.

Changes:

• Added CSP nonce attributes to Google Consent Mode v2 script tag (line 57)
• Added CSP nonce attributes to debug mode scripts (lines 68, 71)
• Added CSP nonce attributes to consent manager configuration and frontend script tags (lines 167-168)