Swagger UI scripts blocked by CSP when using 'strict-dynamic'

[person-unko]

API Platform version(s) affected: 4.0.16

Description
When visiting /api, the Swagger UI scripts fail to load due to Content Security Policy (CSP) restrictions. Specifically, the CSP rule "script-src 'self' 'strict-dynamic'" prevents API Platform's bundled Swagger UI scripts from executing because they are included without a nonce.

How to reproduce

1. Configure CSP with "script-src 'self' 'strict-dynamic'".
2. Visit /api and check the browser console.
3. Observe that Swagger UI scripts are blocked due to CSP violations.

Possible Solution

• Provide a configuration option to allow specifying a nonce for these scripts.

Additional Context
Example CSP error message from the browser console:

Refused to load the script 'https://127.0.0.1/assets/bundles/apiplatform/swagger-ui/swagger-ui-bundle-9eUildt.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'strict-dynamic'". Note that 'strict-dynamic' is present, so host-based allowlisting is disabled. Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

[stevenbrookes]

Yes it would be good to sort this out - we see the same issue.