Sets up scripts to place pseudo nonces to be transformed by revproxy.

[timcosgrove]

Description

Adds nonce placeholders which will be substituted by the reverse proxy.

Ticket

#789

Developer Task

Tasks

Preview Give feedback

1. PR submitted against the main branch of next-build.
2. Link to the issue that this PR addresses (if applicable).
3. Define all changes in your PR and note any changes that could potentially be breaking changes.
4. PR includes steps to test your changes and links to these changes in the Tugboat preview (if applicable).
5. Provided before and after screenshots of your changes (if applicable).
6. Alerted the #accelerated-publishing Slack channel to request a PR review.
7. You understand that once approved, you are responsible for merging your changes into main. (Note that changes to main will move automatically into production.)

Testing Steps

You will need to set up a reverse proxy Preview server tunnel, using the preview instance from this PR: https://github.com/department-of-veterans-affairs/vsp-platform-revproxy/pull/687

Confirm that a Staging Content release has gone out with this code:

1. Visit https://main-medc0xjkxm4jmpzxl3tfbcs7qcddsivh.ci.cms.va.gov/admin/config/system/feature_toggle and make sure the Event & Event Listing feature flags are enabled.
2. Run a Content Release: Staging run, with this branch tcosgrove_nonce selected rather than main: https://github.com/department-of-veterans-affairs/next-build/actions/workflows/content-release-staging.yml

Then, run through these steps:

1. Open the web inspector on your browser, and have the console open and ready.
2. Visit https://staging.va.gov/outreach-and-events/events/. Confirm that you are tunneling through the Preview reverse proxy instance.
3. Confirm in the response headers that you are seeing Next Build content.
4. Confirm that you do not see any errors in the console indicating that Content Security Policy is preventing scripts from loading.
5. Confirm that the page is loading fully as expected, including the header & footer.
6. View source (not with the web inspector; actual source), and search for ssgManifest.js. For the script tag where that is loaded, you should see a nonce included in the script tag, something like the following:

<script src="/_next/static/vagovprod/_ssgManifest.js" defer="" nonce="cizixRUsiHF42ScikEQvnlNficBfj3Mr"></script>

Do the above steps again for any individual event page.

[timcosgrove]

This is very old and should probably be removed.