Compatibility with Content Security Policy

I have opened a MR and attached a patch file with a different approach.

My approach leverages the Attach Inline → module for adding the CSS and JS to the page. With this approach, if you have the Content Security Policy → module enabled hashes/nonces are automatically added to the page's policy to remove the need for 'unsafe-inline', and limit the risk of Cross Site Scripting vulnerabilities. In addition, by keeping the scripts inline, we preserve the existing token replacement feature.