fix(refactor): use csp_nonce_html_transformer library

[JakeChampion]

csp_nonce_html_transformer internally has a custom non-asyncify wasm build of lol-html which only includes the setAttribute method, as that is all that is needed to add nonce attributes to elements. This reduces the wasm size by ~70%. It is also using the latest v2.0.0 of lol-html.

csp_nonce_html_transformer is a standalone library for Deno which takes in a Response instance and will add CSP directives to the configured CSP header and will add nonce attributes to the response body.

[netlify]

✅ Deploy Preview for csp-nonce ready!

Name	Link
🔨 Latest commit	f696b08
🔍 Latest deploy log	https://app.netlify.com/sites/csp-nonce/deploys/67361a574c255400087aeeb4
😎 Deploy Preview	https://deploy-preview-96--csp-nonce.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[ndhoule]

In addition to the inline comments, a few other questions:

1. The main issue we're experiencing with the CSP extension right now is crashes at runtime; can you explain how this PR addresses that problem? Were you able to repro the problem and confirm that this changeset fixes it?
2. The CSP extension/plugin are one of our most used extensions/plugins; given how large a set of changes this is, what's our testing/rollout strategy for these changes?
3. Can you add the @netlify/composable-platform team as an admin to the https://github.com/netlify/csp_nonce_html_transformer repository?

[ndhoule]

In addition to the inline comments, a few other questions:

1. The main issue we're experiencing with the CSP extension right now is crashes at runtime; can you explain how this PR addresses that problem? Were you able to repro the problem and confirm that this changeset fixes it?
2. The CSP extension/plugin are one of our most used extensions/plugins; given how large a set of changes this is, what's our testing/rollout strategy for these changes?
3. Can you add the @netlify/composable-platform team as an admin to the https://github.com/netlify/csp_nonce_html_transformer repository?

[JakeChampion]

@ndhoule unfortunately I don't have admin rights on https://github.com/netlify/csp_nonce_html_transformer/ - I think right now only Netlify GitHub Owners are admins... @eduardoboucas I see you are an owner, would you be able to add @netlify/composable-platform team as an admin to the https://github.com/netlify/csp_nonce_html_transformer repository 🙏

[JakeChampion]

In addition to the inline comments, a few other questions:

1. The main issue we're experiencing with the CSP extension right now is crashes at runtime; can you explain how this PR addresses that problem? Were you able to repro the problem and confirm that this changeset fixes it?

Yes, the library uses a custom build of lol-html to wasm, specifically it uses a version which does not use asyncify, and asyncify was the cause of the crashes from what we could see in the logs - I've deployed this plugin to test sites which have pages of large (13MB+) html and pages of HTML which customers saw issues with, all those are behaving correctly for me, and I have given them a high load from a single POP and not seen any isolate crashes or errors thrown.

2. The CSP extension/plugin are one of our most used extensions/plugins; given how large a set of changes this is, what's our testing/rollout strategy for these changes?

We can release the plugin as a prerelease at first, and deploy it to some site that we own which get medium-to-large traffic, and then eventually promote it to a full release. Once at a full release, we would update the extension to use it.

[ndhoule]

Thanks for making these changes!