security(csp): version-safe inline-script nonce wrapper + strengthen PO/MO instructions

[TheWitness]

Summary

Part of the fleet-wide CSP-nonce rollout (mirrors the pilot Cacti/plugin_mactrack#374).

1. Version-safe CSP nonce on inline JavaScript. Adds a wrapper
   plugin_<name>_csp_nonce() and applies it to every inline <script> block, so
   pages stay compatible with Cacti's Content-Security-Policy nonce enforcement.
2. Strengthened i18n instruction in .github/copilot-instructions.md — the
   .po/.mo files are never committed (Weblate owns them); only cacti.pot.

Wrapper (cross-version safe)

function plugin_<name>_csp_nonce(): string {
	if (class_exists('CactiSecureHeaders')) {
		return CactiSecureHeaders::getNonceAttribute();
	}

	return '';
}

Emits the per-request nonce="..." on Cacti releases that ship CactiSecureHeaders
(present on both develop and 1.2.x), and '' on older releases — so the tag
stays valid either way. The wrapper lives in the plugin's functions library where one
exists, otherwise in setup.php (loaded on every Cacti page by the plugin loader).

Also

• tests/Unit/CspNonceTest.php covers the empty-string fallback, the string
  return type, and delegation to CactiSecureHeaders.
• Where the plugin emits its own external <script src> / CSS <link>, those go
  through Cacti's get_md5_include_js() / get_md5_include_css() helpers (automatic
  nonce + md5 cache-buster).
• locales/po/cacti.pot regenerated for shifted source line references; the
  per-language .po/.mo catalogs are intentionally not committed.

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical CSP integration and test issues remain unresolved.

Review effort: Lite
Findings: 2 · 1

Open (3)

• CSP nonce concatenation is emitted outside PHP · New
• Avoid asserting CactiSecureHeaders is absent in supported CI · New
• Use quicktree_csp_nonce for the non-lifecycle helper · New

What changed in this PR

Adds version-safe CSP nonce support for QuickTree inline scripts and strengthens translation catalog handling.

Changes:

• Adds CSP nonce helper and updated asset inclusion.
• Adds nonce tests and refreshes POT references.
• Updates changelog and PO/MO guidance.

File	Review findings
tests/​Unit/​CspNonceTest.php	Critical (1 vote): Fallback assertion fails when CactiSecureHeaders exists; also affects line 27.
setup.php	Nit (2 votes): Rename the helper to quicktree_csp_nonce() to match naming conventions.
quicktree.php	Critical (4 votes): Nonce concatenation is outside PHP mode and is emitted literally, so CSP blocks the script.
locales/​po/​cacti.pot	Updated generated source references.
CHANGELOG.md	Documents the CSP change.
.github/​copilot-instructions.md	Strengthens PO/MO catalog handling guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.