refactor(cspSsrNonce): refactor html injection

[GalacticHypernova]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

This PR introduces several changes and fixes issues brought on by #670 and #710 :

1. It unifies the nonce replacement logic from 3 passes (for each elem type) to a single pass, improving performance on large HTML and unifying nonce overwrite/prepending logic (which also means script and style nonces are now deduped)
2. It adjusts the nonce pass to accommodate the lack of outer quotes, so it would capture them correctly
3. Most importantly, it fixes the XSS openings that the previous PR's re-introduced

While I couldn't seem to get a minimal test case to demonstrate it, I did encounter it myself in my own app:

Where some of the data in NUXT_DATA has gotten malformed:

With these changes, the app loads with no issues

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes (if not applicable, please state why)

[vercel]

@GalacticHypernova is attempting to deploy a commit to the Baroshem's projects Team on Vercel.

A member of the Team first needs to authorize it.

[GalacticHypernova]

There may be a way to improve the performance of this fix by converting from a negative look-behind to a regular preceding match (negative look-behind is a slower op), which I tried, but I couldn't get it to work on my test case, so due to the urgency of this PR to patch the existing XSS risks I will keep working on it independently and open a new PR when I find the solution.