fix(cspNonce): don't overwrite existing nonce values

[thebanjomatic]

Fixes: #16414

Description

With this change, we now verify that the nonce attribute doesn't already exist on the tag prior to injecting the nonce value.

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[thebanjomatic]

@sapphi-red as a side-note, do you remember why <style> tags were removed from this feature: 020c971

It caught me off guard when looking at this that <script> and <link> tags are automatically tagged with a nonce value, but inline <style> tags are not. Is this something the team would be open to adding back in?

[sapphi-red]

While I was working on #16052, I was thinking hard about what tags should have the nonce attribute injected. The first idea was to only inject tags that cannot be achieved by chaning the input HTML (e.g. <script type="module">). The second idea was to inject it into all tags that CSP allows using nonce (e.g. <script>, <style>). When I did that commit, I decided to go with the first idea. The reason was because I wasn't sure the whole list of tags that needs the nonce attribute to be set and another reason was because I thought it's easy to add it later rather than removing it. But it seems I forgot to skip injecting nonce attributes to script tags without type=module.

On second thought, I think it makes sense to go with the second idea. Vite already injects the nonce to <script>, <link rel="stylesheet">, <link rel="modulepreload">, <link rel="preload">. If I understand the CSP spec correctly, the only missing tag is the <style> tag.

[thebanjomatic]

Thanks for confirming. I can add a commit to do that to this PR if you think that would be reasonable.

[sapphi-red]

Thanks for confirming. I can add a commit to do that to this PR if you think that would be reasonable.

I would appreciate it if you could create another PR that cherry-picks that commit.

[thebanjomatic]

Thanks for the review. Feedback has been addressed and I have split the adding of nonce to <style> tags into its own PR

[sapphi-red]

/ecosystem-ci run

[vite-ecosystem-ci]

📝 Ran ecosystem CI on 259ba21: Open

suite	result	latest scheduled
nuxt	✅ success	❌ failure

✅ analogjs, astro, histoire, ladle, laravel, marko, previewjs, quasar, qwik, rakkas, remix, sveltekit, unocss, vike, vite-plugin-pwa, vite-plugin-react, vite-plugin-react-pages, vite-plugin-react-swc, vite-plugin-svelte, vite-plugin-vue, vite-setup-catalogue, vitepress, vitest