Pull Request for Issue #37461

Summary of Changes

Improve nonce and strict-dynamic handling within the http header plugin:

• once the nonce setting is enabled always add the nonce to the header and dont require an specific tag + bc handling.
• make sure strict-dynamic is the first setting set in the header.

Testing Instructions

First test

• Enable the nonce setting within the plugin
• check the http header
• confirm that the nonce is not added to the header
• add {nonce} to script-src
• confirm that the nonce is now at the header
• apply the patch
• confirm the nonce is still at the header
• remove the {nonce} tag
• confirm the nonce is still at the header

Seccond test

• Enable the strict-dynamic setting
• set some own script-src settings and end that line with ";"
• confirm that the strict dynamic setting is than showed outside of the script-src
• apply this patch
• confirm that this issue is resolved

Actual result BEFORE applying this Pull Request

• Nonce only added to the header once the {nonce} tag is aviable
• In some cases the strict-dynamic setting is generated outside of the script-src

Expected result AFTER applying this Pull Request

• Nonce is added to the header once the setting is enabled
• The {nonce} tag will still be removed to keep B/C
• The strict-dynamic option is now always at the first option once enabled

Documentation Changes Required

n.a. (as the {nonce} was never documented)