Fix csp errrors, DEV-1113

Signed-off-by: Iman Aboheydary <iman@customgento.com>

Author: iranimij

Model/ScriptGenerator.php

@@ -4,6 +4,8 @@
 
 namespace CustomGento\Cookiebot\Model;
 
+use Magento\Csp\Helper\CspNonceProvider;
+
 class ScriptGenerator
 {
     private const COOKIEBOT_SCRIPT_FORMAT = '<script
@@ -12,35 +14,34 @@ class ScriptGenerator
             src="https://consent.cookiebot.com/uc.js"
             data-cbid="%s"
             %s
+            %s
             type="text/javascript" async></script>';
     private const EU_COOKIEBOT_SCRIPT_FORMAT = '<script
             id="Cookiebot"
             data-cfasync="false"
             src="https://consent.cookiebot.eu/uc.js"
             data-cbid="%s"
             %s
+            %s
             type="text/javascript" async></script>';
 
-    /**
-     * @var Config
-     */
-    private $config;
-
-    public function __construct(Config $config)
-    {
-        $this->config = $config;
+    public function __construct(
+        private readonly Config $config,
+        private readonly CspNonceProvider $cspNonceProvider
+    ) {
     }
 
     public function generate(): string
     {
         $cookiebotId = $this->config->getId();
         $dataCulture = $this->config->getDataCulture() ?
             sprintf('data-culture="%s"', $this->config->getDataCulture()) : '';
+        $nonce       = sprintf('nonce="%s"', $this->cspNonceProvider->generateNonce());
 
         if ($this->config->useEuCdn()) {
-            return sprintf(self::EU_COOKIEBOT_SCRIPT_FORMAT, $cookiebotId, $dataCulture);
+            return sprintf(self::EU_COOKIEBOT_SCRIPT_FORMAT, $cookiebotId, $dataCulture, $nonce);
         }
 
-        return sprintf(self::COOKIEBOT_SCRIPT_FORMAT, $cookiebotId, $dataCulture);
+        return sprintf(self::COOKIEBOT_SCRIPT_FORMAT, $cookiebotId, $dataCulture, $nonce);
     }
 }

etc/csp_whitelist.xml

@@ -5,7 +5,11 @@
         <policy id="script-src">
             <values>
                 <value id="cookiebot" type="host">consent.cookiebot.com</value>
+                <value id="cookiebot_cdn" type="host">consentcdn.cookiebot.com</value>
                 <value id="cookiebot_eu" type="host">consent.cookiebot.eu</value>
+                <value id="cookiebot_cdn_eu" type="host">consentcdn.cookiebot.eu</value>
+                <!-- Hash for Cookiebot inline script (nonce not fully supported by uc.js) -->
+                <value id="cookiebot_inline" type="hash" algorithm="sha256">izGUmFn9PZE6G7QuIdXAy77nhcrcwBISVZL+PdWAZFA=</value>
             </values>
         </policy>
         <policy id="frame-src">