CSP: Set nonce attribute on Webpack injected bundles (#33298)

* CSP: Set __webpack_nonce__

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

public/app/index.ts

@@ -1,4 +1,5 @@
 declare let __webpack_public_path__: string;
+declare let __webpack_nonce__: string;
 
 /**
  * Check if we are hosting files on cdn and set webpack public path
@@ -11,5 +12,9 @@ if ((window as any).public_cdn_path) {
 (window as any).__grafana_public_path__ =
   __webpack_public_path__.substring(0, __webpack_public_path__.lastIndexOf('build/')) || __webpack_public_path__;
 
+if ((window as any).nonce) {
+  __webpack_nonce__ = (window as any).nonce;
+}
+
 import app from './app';
 app.init();

public/views/index-template.html

@@ -263,6 +263,9 @@
         [[if .ContentDeliveryURL]]
           window.public_cdn_path = '[[.ContentDeliveryURL]]public/build/';
         [[end]]
+        [[if .Nonce]]
+          window.nonce = '[[.Nonce]]';
+        [[end]]
     </script>
 
     [[if .GoogleTagManagerId]]