Strict CSP

This plugin enforces a Strict Content Security Policy (CSP) on the frontend and login screen. This helps mitigate cross-site scripting (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see #59446).

In #58664, the manual construction of script tags was eliminated from WP_Scripts and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in #39941. This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing <script> tags. Some bundled WordPress core themes still do this incorrectly (which has been reported in Trac as #63806). For example, do not do this:

function my_theme_supports_js() {
    echo '<script>document.body.classList.remove("no-js");<…